cedric/annu-kute-ced
1
0
Fork 0
forked from ORGANISATION-KA-INTERNATIONALE/FEDIVERSE-OKI
Code Pull Requests Actions Activity

fix(security): systematic output escaping with e() and video-card partial

Browse Source
This commit is contained in:
cedric
2026-07-27 01:54:42 +04:00
parent 442c262539
commit a28ba8bfec
8 changed files with 300 additions and 185 deletions
Download Patch File Download Diff File Expand all files Collapse all files
includes/hero-section.php
+8 -3
View File
@@ -45,7 +45,7 @@ if ($heroType === 'none') {
</div>
<div class="hero-video-container">
<iframe
src="<?php echo PEERTUBE_URL; ?>/videos/embed/<?php echo $liveStream['id']; ?>?autoplay=1&muted=1"
src="<?php echo e(PEERTUBE_URL . '/videos/embed/' . $liveStream['id'] . '?autoplay=1&muted=1'); ?>"
frameborder="0"
allowfullscreen="allowfullscreen"
allow="autoplay; fullscreen"
@@ -64,7 +64,7 @@ if ($heroType === 'none') {
<i class="fas fa-user-circle" aria-hidden="true"></i>
</div>
<?php else: ?>
<img src="<?php echo $liveStream['channelAvatar']; ?>" alt="Avatar de la chaîne <?php echo htmlspecialchars($liveStream['channel']); ?>" class="channel-avatar">
<img src="<?php echo e($liveStream['channelAvatar']); ?>" alt="Avatar de la chaîne <?php echo htmlspecialchars($liveStream['channel']); ?>" class="channel-avatar">
<?php endif; ?>
<span class="channel-name"><?php echo htmlspecialchars($liveStream['channel']); ?></span>
</div>
@@ -82,7 +82,12 @@ if ($heroType === 'none') {
$bgImageStyle = 'background-image: url(\'' . htmlspecialchars(NEXT_LIVE_IMAGE) . '\');';
}
?>
<div class="hero-next-live" style="<?php echo $bgImageStyle; ?>" nonce="<?php echo getCspNonce(); ?>">
<?php if (!empty($bgImageStyle)): ?>
<style nonce="<?php echo getCspNonce(); ?>">
.hero-next-live { <?php echo $bgImageStyle; ?> }
</style>
<?php endif; ?>
<div class="hero-next-live">
<?php if (!empty(NEXT_LIVE_IMAGE) && file_exists(NEXT_LIVE_IMAGE)): ?>
<div class="hero-next-live-image-container">
<img src="<?php echo htmlspecialchars(NEXT_LIVE_IMAGE); ?>"