Skip to content

Commit f179fa7

Browse files
authored
Fix stored XSS in Calendar name (CVE-2023-24690) (#7681)
2 parents a3e4e86 + 8f5e661 commit f179fa7

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

src/api/routes/calendar/calendar.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -193,7 +193,7 @@ function NewCalendar(Request $request, Response $response, $args): Response
193193
{
194194
$input = $request->getParsedBody();
195195
$Calendar = new Calendar();
196-
$Calendar->setName($input['Name']);
196+
$Calendar->setName(InputUtils::filterString($input['Name']));
197197
$Calendar->setForegroundColor($input['ForegroundColor']);
198198
$Calendar->setBackgroundColor($input['BackgroundColor']);
199199
$Calendar->save();

0 commit comments

Comments
 (0)