0ct0pu5/forkbb
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Fix xss in __() function

Browse source 
String not found in translation files must be escaped.
This commit is contained in:
Visman 2021-11-20 13:54:54 +07:00
parent 960bf497c8
commit 84a2bd98d1
2 changed files with 6 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
app/Core/Lang.php
View file

@ -101,7 +101,7 @@ class Lang
/**
* Ищет сообщение в загруженных переводах
*/
public function get(string $message, string $lang = null) /* : string|array */
public function get(string $message, string $lang = null) /* : null|string|array */
{
if (
null !== $lang
@ -116,7 +116,7 @@ class Lang
}
}
return $message;
return null; //$message;
}
/**

6
app/functions.php
View file

@ -48,7 +48,9 @@ function __(/* string|arrray */ $arg): string
$tr = $lang->get(\reset($arg));
$args = \array_slice($arg, 1);
if (\is_array($tr)) {
if (null === $tr) {
$tr = e($tr);
} elseif (\is_array($tr)) {
$tr = $lang->getForm($tr, \reset($args));
$args = \array_slice($args, 1);
}
@ -62,7 +64,7 @@ function __(/* string|arrray */ $arg): string
return \sprintf($tr, ...$args);
}
} else {
return $lang->get($arg);
return $lang->get($arg) ?? e($arg);
}
}