From 65a993fe06abaadcbcb23f6c239db36eb6471954 Mon Sep 17 00:00:00 2001 From: fishystock <215427190+fishystock@users.noreply.github.com> Date: Fri, 7 Aug 2026 18:58:17 -0400 Subject: security: fix stored xss on calendar api --- templates/themes/calendar/calendar.html | 14 ++++++++++++++ templates/themes/calendar/calendarpost.php | 6 +++++- 2 files changed, 19 insertions(+), 1 deletion(-) (limited to 'templates') diff --git a/templates/themes/calendar/calendar.html b/templates/themes/calendar/calendar.html index 12113dcd..4b5c99ae 100644 --- a/templates/themes/calendar/calendar.html +++ b/templates/themes/calendar/calendar.html @@ -55,6 +55,20 @@ } else { event.allDay = false; } + + var _url = new URL(event.url, window.location.href); + var _scheme = _url.protocol.toLowerCase(); + + // Replace stored javascript/data URI attempts + if(_scheme === 'javascript:' || _scheme === 'data:') { + event.url = "#removed"; + } + + // Only accept #a-zA-Z to avoid CSS injection. + if (/^[#a-zA-Z]+$/.test(event.color) == false) { + event.color = "#removed"; + } + element.find('.fc-title').append("
" + event.description); element.css('background-color',event.color); }, diff --git a/templates/themes/calendar/calendarpost.php b/templates/themes/calendar/calendarpost.php index ac2c1a72..7ad9377a 100644 --- a/templates/themes/calendar/calendarpost.php +++ b/templates/themes/calendar/calendarpost.php @@ -51,7 +51,11 @@ $method = $_SERVER['REQUEST_METHOD']; } elseif ($method == 'GET') { // Method is GET $query = query("SELECT * FROM calendar_events ORDER BY id") or error(db_error()); - echo json_encode($query->fetchAll(PDO::FETCH_ASSOC), JSON_THROW_ON_ERROR); + + header('Content-Type: application/json; charset=utf-8'); + header('X-Content-Type-Options: nosniff'); + + echo json_encode($query->fetchAll(PDO::FETCH_ASSOC), JSON_THROW_ON_ERROR); } ?> -- cgit v1.3