never allow {{ }} in user-input

2024-05-10 17:23:25 +02:00
parent c07ff16274
commit 1a5680d2a8
1 changed files with 3 additions and 0 deletions
--- a/lib/Froxlor/UI/Request.php
+++ b/lib/Froxlor/UI/Request.php
@@ -101,6 +101,9 @@ class Request
 			unset($value);

 			$antiXss = new AntiXSS();
+			$antiXss->addNeverAllowedRegex([
+				'{{(.*)}}' => ''
+			]);

 			// check $_GET
 			PhpHelper::cleanGlobal($_GET, $antiXss);