Omega does not properly escape the site_name variable when it uses it for the alt or title attributes in the $logo_img and $linked_logo_img template variables.

This means if a site_name has any html code in it, that rendering the logo image in the page could render undesired (eg xss) html codes.

Patch coming below.

CommentFileSizeAuthor
#1 omega-escape-sitename-in-logo-attributes-1395848.patch7.59 KBjwilson3

Comments

jwilson3’s picture

jwilson3
Primary language English
Location Ecuador
commented
Status: Active » Needs review
StatusFileSize
new omega-escape-sitename-in-logo-attributes-1395848.patch7.59 KB

This patch also cleans up a bunch of whitespace issues in the template.php file.

fubhy’s picture

fubhy commented
Status: Needs review » Fixed

Commited. Thanks

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.