Page MenuHomePhabricator
Files F15360398

D12506.diff
No OneTemporary
Actions

D12506.diff
View Options

diff --git a/src/applications/settings/panel/PhabricatorDisplayPreferencesSettingsPanel.php b/src/applications/settings/panel/PhabricatorDisplayPreferencesSettingsPanel.php
--- a/src/applications/settings/panel/PhabricatorDisplayPreferencesSettingsPanel.php
+++ b/src/applications/settings/panel/PhabricatorDisplayPreferencesSettingsPanel.php
@@ -30,9 +30,8 @@
$e_editor = null;
if ($request->isFormPost()) {
$monospaced = $request->getStr($pref_monospaced);
-
- // Prevent the user from doing stupid things.
- $monospaced = preg_replace('/[^a-z0-9 ,".]+/i', '', $monospaced);
+ $monospaced = PhabricatorUserPreferences::filterMonospacedCSSRule(
+ $monospaced);
$preferences->setPreference($pref_titles, $request->getStr($pref_titles));
$preferences->setPreference($pref_editor, $request->getStr($pref_editor));
diff --git a/src/applications/settings/storage/PhabricatorUserPreferences.php b/src/applications/settings/storage/PhabricatorUserPreferences.php
--- a/src/applications/settings/storage/PhabricatorUserPreferences.php
+++ b/src/applications/settings/storage/PhabricatorUserPreferences.php
@@ -101,4 +101,9 @@
return $large;
}
+ public static function filterMonospacedCSSRule($monospaced) {
+ // Prevent the user from doing dangerous things.
+ return preg_replace('/[^a-z0-9 ,".]+/i', '', $monospaced);
+ }
+
}
diff --git a/src/view/page/PhabricatorStandardPageView.php b/src/view/page/PhabricatorStandardPageView.php
--- a/src/view/page/PhabricatorStandardPageView.php
+++ b/src/view/page/PhabricatorStandardPageView.php
@@ -287,7 +287,7 @@
$user = $request->getUser();
if ($user) {
$monospaced = $user->loadPreferences()->getPreference(
- PhabricatorUserPreferences::PREFERENCE_MONOSPACED);
+ PhabricatorUserPreferences::PREFERENCE_MONOSPACED);
}
}
@@ -295,12 +295,19 @@
$font_css = null;
if (!empty($monospaced)) {
+ // We can't print this normally because escaping quotation marks will
+ // break the CSS. Instead, filter it strictly and then mark it as safe.
+ $monospaced = new PhutilSafeHTML(
+ PhabricatorUserPreferences::filterMonospacedCSSRule(
+ $monospaced));
+
$font_css = hsprintf(
'<style type="text/css">'.
'.PhabricatorMonospaced, '.
'.phabricator-remarkup .remarkup-code-block '.
'.remarkup-code { font: %s !important; } '.
- '</style>', $monospaced);
+ '</style>',
+ $monospaced);
}
return hsprintf(

File Metadata

Mime Type
text/plain
Expires
Wed, Mar 12, 8:27 AM (43 m, 6 s ago)
Storage Engine
blob
Storage Format
Encrypted (AES-256-CBC)
Storage Handle
7579816
Default Alt Text
D12506.diff (2 KB)

Event Timeline

Phabricator · Built by Phacility