Merge pull request #3374 from weseek/fix/62165-prevent-xss-about-app-settings

Fix/62165 prevent xss about app settings

CHANGES.md

@@ -2,6 +2,7 @@
 
 ## v4.2.8-RC
 
+* Fix: Pass app title value through the XSS filter
 * Fix: Fixed not being able to update ses settings
     * Introduced by v4.2.0
 * Fix: Fixed the display of updtedAt and createdAt being reversed

src/server/views/installer.html

@@ -10,7 +10,7 @@
 
   <meta name="viewport" content="width=device-width,initial-scale=1">
 
-  <meta name="apple-mobile-web-app-title" content="{{ appService.getAppTitle() }}">
+  <meta name="apple-mobile-web-app-title" content="{{ appService.getAppTitle() | preventXss }}">
 
   {% include './widget/headers/favicon.html' %}
   {% include './widget/headers/ie11-polyfills.html' %}

src/server/views/layout/layout.html

@@ -10,7 +10,7 @@
 
   <meta name="viewport" content="width=device-width,initial-scale=1">
 
-  <meta name="apple-mobile-web-app-title" content="{{ appService.getAppTitle() }}">
+  <meta name="apple-mobile-web-app-title" content="{{ appService.getAppTitle() | preventXss }}">
 
   {{ getConfig('crowi', 'customize:header') | default('') }}
 

src/server/views/login.html

@@ -34,7 +34,7 @@
     <div class="col-md-12">
       <div class="login-header mx-auto">
         <div class="logo mb-3">{% include 'widget/logo.html' %}</div>
-        <h1>{{ appService.getAppTitle() }}</h1>
+        <h1>{{ appService.getAppTitle() | preventXss }}</h1>
 
           <div class="login-form-errors px-3">
             {% if isLdapSetupFailed() %}