luna/mastodon
0
0
Fork 0
mirror of https://github.com/lunaisnotaboy/mastodon.git synced 2024-12-22 05:08:03 +00:00
Code Issues Projects Releases Wiki Activity

Fix #457 - escape JSON in INITIAL_STATE (this bug only ever allowed a user to xss themselves rather than anyone else)

Browse source
This commit is contained in:
Eugen Rochko 2017-01-12 03:54:50 +01:00
parent 7951e7ffd5
commit 4a2ee43e80
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
app/views/home/index.html.haml
View file

@ -1,6 +1,6 @@
- content_for :header_tags do
:javascript
window.INITIAL_STATE = #{render(file: 'home/initial_state', formats: :json)}
window.INITIAL_STATE = #{json_escape(render(file: 'home/initial_state', formats: :json))}
= javascript_include_tag 'application'