diff options
| author | Unknwon <u@gogs.io> | 2017-10-14 23:53:20 -0400 |
|---|---|---|
| committer | Unknwon <u@gogs.io> | 2017-10-14 23:53:20 -0400 |
| commit | ea313d0c1e6e467273bcd44fb1d42ff8e9045454 (patch) | |
| tree | 59379aa974985bc8872252eeb18f58b8070d3e8b /routes/api | |
| parent | c1507eda4516d52081bf20e587089f73e19655a0 (diff) | |
SECURITY: HTML injection in user search API
Reported by Tim Hawes.
Diffstat (limited to 'routes/api')
| -rw-r--r-- | routes/api/v1/user/user.go | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/routes/api/v1/user/user.go b/routes/api/v1/user/user.go index dbf727de..8326eea5 100644 --- a/routes/api/v1/user/user.go +++ b/routes/api/v1/user/user.go @@ -12,6 +12,7 @@ import ( "github.com/gogits/gogs/models" "github.com/gogits/gogs/models/errors" "github.com/gogits/gogs/pkg/context" + "github.com/gogits/gogs/pkg/markup" ) func Search(c *context.APIContext) { @@ -39,7 +40,7 @@ func Search(c *context.APIContext) { ID: users[i].ID, UserName: users[i].Name, AvatarUrl: users[i].AvatarLink(), - FullName: users[i].FullName, + FullName: markup.Sanitize(users[i].FullName), } if c.IsLogged { results[i].Email = users[i].Email |