aboutsummaryrefslogtreecommitdiffstats
path: root/libempathy-gtk
diff options
context:
space:
mode:
authorGuillaume Desmottes <guillaume.desmottes@collabora.co.uk>2011-10-19 00:32:52 +0800
committerGuillaume Desmottes <guillaume.desmottes@collabora.co.uk>2011-10-19 00:35:01 +0800
commit739aca418457de752be13721218aaebc74bd9d36 (patch)
tree2af8215e34bb76e737583ebaf243c33b983ae1b1 /libempathy-gtk
parent4be40f870291191e95035cd08b8f0733c9af1828 (diff)
downloadgsoc2013-empathy-739aca418457de752be13721218aaebc74bd9d36.tar
gsoc2013-empathy-739aca418457de752be13721218aaebc74bd9d36.tar.gz
gsoc2013-empathy-739aca418457de752be13721218aaebc74bd9d36.tar.bz2
gsoc2013-empathy-739aca418457de752be13721218aaebc74bd9d36.tar.lz
gsoc2013-empathy-739aca418457de752be13721218aaebc74bd9d36.tar.xz
gsoc2013-empathy-739aca418457de752be13721218aaebc74bd9d36.tar.zst
gsoc2013-empathy-739aca418457de752be13721218aaebc74bd9d36.zip
theme_adium_append_message: escape alias before displaying it
Not doing so can lead to nasty HTML injection from hostile users. https://bugzilla.gnome.org/show_bug.cgi?id=662035
Diffstat (limited to 'libempathy-gtk')
-rw-r--r--libempathy-gtk/empathy-theme-adium.c7
1 files changed, 5 insertions, 2 deletions
diff --git a/libempathy-gtk/empathy-theme-adium.c b/libempathy-gtk/empathy-theme-adium.c
index 42c0914c8..66b03205d 100644
--- a/libempathy-gtk/empathy-theme-adium.c
+++ b/libempathy-gtk/empathy-theme-adium.c
@@ -782,7 +782,7 @@ theme_adium_append_message (EmpathyChatView *view,
EmpathyContact *sender;
TpMessage *tp_msg;
TpAccount *account;
- gchar *body_escaped;
+ gchar *body_escaped, *name_escaped;
const gchar *name;
const gchar *contact_id;
EmpathyAvatar *avatar;
@@ -947,8 +947,10 @@ theme_adium_append_message (EmpathyChatView *view,
}
}
+ name_escaped = g_markup_escape_text (name, -1);
+
theme_adium_append_html (theme, func, html, body_escaped,
- avatar_filename, name, contact_id,
+ avatar_filename, name_escaped, contact_id,
service_name, message_classes->str,
timestamp, is_backlog, empathy_contact_is_user (sender));
@@ -961,6 +963,7 @@ theme_adium_append_message (EmpathyChatView *view,
priv->last_is_backlog = is_backlog;
g_free (body_escaped);
+ g_free (name_escaped);
g_string_free (message_classes, TRUE);
}