Fix issue with not escaping profile display email address.
Patch by rat.
diffs (48 lines):
diff -r fe18f5fe4113 -r 0c901a3e684a bin/upgrading/en.dat
--- a/bin/upgrading/en.dat Sat Aug 08 15:16:42 2009 +0000
+++ b/bin/upgrading/en.dat Sat Aug 08 18:04:44 2009 +0000
@@ -2741,6 +2741,8 @@ setting.randompaidgifts.option.paid=If y
setting.randompaidgifts.option.note=You may receive a paid account from
someone you do not know.
+setting.profileemail.error.email.invalid=Invalid email address entered.
+
setting.safesearch.error.invalid=Invalid safe search setting.
setting.safesearch.label=Safe Search Filter
diff -r fe18f5fe4113 -r 0c901a3e684a cgi-bin/DW/Setting/ProfileEmail.pm
--- a/cgi-bin/DW/Setting/ProfileEmail.pm Sat Aug 08 15:16:42 2009 +0000
+++ b/cgi-bin/DW/Setting/ProfileEmail.pm Sat Aug 08 18:04:44 2009 +0000
@@ -57,7 +57,17 @@ sub save {
my $email = $class->get_arg( $args, "email" );
$email = LJ::trim( $email || "" );
- $u->profile_email( $email );
+ # ensure a valid email address is given.
+ my @errors;
+ if ( $email ) {
+ LJ::check_email( $email, \...@errors );
+ }
+
+ if ( @errors ) {
+ $class->errors( "email" => $class->ml(
'setting.profileemail.error.email.invalid' ) ) ;
+ } else {
+ $u->profile_email( $email );
+ }
return 1;
}
diff -r fe18f5fe4113 -r 0c901a3e684a htdocs/userinfo.bml
--- a/htdocs/userinfo.bml Sat Aug 08 15:16:42 2009 +0000
+++ b/htdocs/userinfo.bml Sat Aug 08 18:04:44 2009 +0000
@@ -176,7 +176,9 @@ body<=
return qq(<a href="$l->{url}">$l->{text}</a>) if $l->{url};
return $l->{text};
} elsif ( $l->{email} ) {
- return LJ::mangle_email_address( $l->{email} );
+ # the ehtml call here shouldn't be necessary, but just in case
they slip in an email
+ # that contains Bad Stuff, escape it
+ return LJ::mangle_email_address( LJ::ehtml( $l->{email} ) );
} else {
return "(Error in Linkification)";
}
_______________________________________________
dw-changelog mailing list
[email protected]
http://lists.dwscoalition.org/mailman/listinfo/dw-changelog
