chalec
/
ctrlv-privatebin
6
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Potentiel security bug corrected 

Bug reproduction: 1) paste texte containing html/javascript. 2) send 3)
clic "Raw text"  4) refresh: The html/javascript is interpreted instead
of just displayed.
Under some versions of Chrome, it happens without refreshing.
This bug was corrected.

(cherry picked from commit 4f8750bbddcb137213529875e45e3ace3be9a769)
This commit is contained in:
Sebastien SAUVAGE 2014-01-20 21:06:31 +01:00 committed by El RIDO
parent e7feca0e53
commit daf5522b1e
1 changed files with 3 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
js/zerobin.js
View File

@ -439,10 +439,9 @@ function stateExistingPaste() {
*/
function rawText()
{
history.pushState(document.title, document.title, 'document.txt');
var paste = $('div#cleartext').text();
var newDoc = document.open('text/plain', 'replace');
newDoc.write(paste);
var paste = $('div#cleartext').html();
var newDoc = document.open('text/html', 'replace');
newDoc.write('<pre>'+paste+'</pre>');
newDoc.close();
}