Josiah Baldwin 04c96eb2ff Fix/xss (#6403) ...

* Fixed filenames not being escaped when editing files

This allowed a possible XSS by naming a file in a particular way on your device.

* Fixed HTML generation in webserver not escaping most things from req.query

This would allow XSS through a very simple phishing attack

* Added HtmlEscape to Mobile default as well

* Added sanitization to SAML redirect and Twitter/Azure

2024-09-26 21:09:34 -07:00

472 KiB

Raw Blame History

View Raw