Bug #105: XSS related bug fixes (#107)

* Bug #105: XSS related bug fixes * Bug #105: XSS related bug fixes
techjoomla · Sep 3, 2018 · 7d9854d · 7d9854d
1 parent 791705b
commit 7d9854d
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 3 deletions.
diff --git a/tjreports/administrator/views/tjreports/tmpl/default.php b/tjreports/administrator/views/tjreports/tmpl/default.php
@@ -103,13 +103,13 @@
 						{
 						?>
 						<a href="<?php echo $link; ?>" title="<?php echo JText::_('COM_TJREPORTS_EDIT'); ?>">
-							<?php echo $row->title; ?>
+							<?php echo htmlspecialchars($row->title, ENT_COMPAT, 'UTF-8'); ?>
 						</a>
 						<?php
 						}
 						else
 						{
-							echo $row->title;
+							echo htmlspecialchars($row->title, ENT_COMPAT, 'UTF-8');
 						}
 						?>
 					</td>

diff --git a/tjreports/site/models/reports.php b/tjreports/site/models/reports.php
@@ -928,6 +928,8 @@ public function getReportLink($reportToLink, $filters)
 	 */
 	public function getDefaultReport($pluginName)
 	{
+		$db        = JFactory::getDBO();
+
 		JTable::addIncludePath(JPATH_ROOT . '/administrator/components/com_tjreports/tables');
 		$reportTable = JTable::getInstance('Tjreport', 'TjreportsTable', array('dbo', $db));
 		$reportTable->load(array('plugin' => $pluginName, 'default' => 1));

diff --git a/tjreports/site/views/reports/tmpl/default.php b/tjreports/site/views/reports/tmpl/default.php
@@ -74,7 +74,7 @@
 		if ($app->isSite() && isset($this->reportData->title))
 		{
 		?>
-			<h2 class="title"><?php echo $this->reportData->title?></h2>
+			<h2 class="title"><?php echo htmlspecialchars($this->reportData->title, ENT_COMPAT, 'UTF-8'); ?></h2>
 		<?php
 		}
 		?>