diff options
| author | John McLear <john@mclear.co.uk> | 2014-10-06 17:11:33 +0100 |
|---|---|---|
| committer | John McLear <john@mclear.co.uk> | 2014-10-06 17:11:33 +0100 |
| commit | 6ec55309a7ef06ef02ca251595b3c81238127a54 (patch) | |
| tree | 1cff809f03e4cdbf2c27283b42ba91100f199cf7 | |
| parent | 64c89613a133f415d9dd4cac35bf1ab693940a91 (diff) | |
| parent | 0962f65c085bc11c4441d5e11049ba68c5fdea11 (diff) | |
| download | etherpad-lite-6ec55309a7ef06ef02ca251595b3c81238127a54.zip | |
Merge pull request #2261 from ether/fix-xss-on-useragent
Fix xss on useragent
| -rw-r--r-- | src/static/js/pad_utils.js | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/static/js/pad_utils.js b/src/static/js/pad_utils.js index bab6aa43..c2ff6fd0 100644 --- a/src/static/js/pad_utils.js +++ b/src/static/js/pad_utils.js @@ -515,12 +515,13 @@ function setupGlobalExceptionHandler() { globalExceptionHandler = function test (msg, url, linenumber) { var errorId = randomString(20); + var userAgent = padutils.escapeHtml(navigator.userAgent); if ($("#editorloadingbox").attr("display") != "none"){ //show javascript errors to the user $("#editorloadingbox").css("padding", "10px"); $("#editorloadingbox").css("padding-top", "45px"); $("#editorloadingbox").html("<div style='text-align:left;color:red;font-size:16px;'><b>An error occured</b><br>The error was reported with the following id: '" + errorId + "'<br><br><span style='color:black;font-weight:bold;font-size:16px'>Please press and hold Ctrl and press F5 to reload this page, if the problem persists please send this error message to your webmaster: </span><div style='color:black;font-size:14px'>'" - + "ErrorId: " + errorId + "<br>URL: " + window.location.href + "<br>UserAgent: " + navigator.userAgent + "<br>" + msg + " in " + url + " at line " + linenumber + "'</div></div>"); + + "ErrorId: " + errorId + "<br>URL: " + window.location.href + "<br>UserAgent: " + userAgent + "<br>" + msg + " in " + url + " at line " + linenumber + "'</div></div>"); } //send javascript errors to the server |