Skip to content

Commit

Permalink
修复 XSS 注入漏洞
Browse files Browse the repository at this point in the history
  • Loading branch information
summerblue committed Sep 20, 2019
1 parent 395b8e5 commit be0f048
Show file tree
Hide file tree
Showing 4 changed files with 158 additions and 1 deletion.
2 changes: 2 additions & 0 deletions app/Observers/TopicObserver.php
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,8 @@ class TopicObserver
{
public function saving(Topic $topic)
{
$topic->body = clean($topic->body, 'user_topic_body');

$topic->excerpt = make_excerpt($topic->body);
}
}
1 change: 1 addition & 0 deletions composer.json
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@
"laravel/framework": "^6.0",
"laravel/tinker": "^1.0",
"mews/captcha": "~3.0",
"mews/purifier": "~3.0",
"overtrue/laravel-lang": "~3.0",
"summerblue/laravel-active": "6.*"
},
Expand Down
139 changes: 138 additions & 1 deletion composer.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

17 changes: 17 additions & 0 deletions config/purifier.php
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
<?php

return [
'encoding' => 'UTF-8',
'finalize' => true,
'cachePath' => storage_path('app/purifier'),
'cacheFileMode' => 0755,
'settings' => [
'user_topic_body' => [
'HTML.Doctype' => 'XHTML 1.0 Transitional',
'HTML.Allowed' => 'div,b,strong,i,em,a[href|title],ul,ol,ol[start],li,p[style],br,span[style],img[width|height|alt|src],*[style|class],pre,hr,code,h2,h3,h4,h5,h6,blockquote,del,table,thead,tbody,tr,th,td',
'CSS.AllowedProperties' => 'font,font-size,font-weight,font-style,margin,width,height,font-family,text-decoration,padding-left,color,background-color,text-align',
'AutoFormat.AutoParagraph' => true,
'AutoFormat.RemoveEmpty' => true,
],
],
];

0 comments on commit be0f048

Please sign in to comment.