Upstream/dynmap
1
0
Fork 0
mirror of https://github.com/webbukkit/dynmap.git synced 2025-01-13 03:10:39 +01:00
Code Issues Projects Releases Wiki Activity

Merge pull request #193 from mikeprimm/master

Browse Source 
Properly stringify chat inputs - prevents bad JSON input, potential security exposures
This commit is contained in:
mikeprimm 2011-06-02 13:21:26 -07:00
commit b2df79eb9c
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
web/js/chat.js
View File

@ -21,7 +21,7 @@ componentconstructors['chat'] = function(dynmap, configuration) {
if (dynmap.options.allowwebchat) { if (dynmap.options.allowwebchat) {
// Accepts 'sendchat'-events to send chat messages to the server. // Accepts 'sendchat'-events to send chat messages to the server.
$(dynmap).bind('sendchat', function(event, message) { $(dynmap).bind('sendchat', function(event, message) {
var data = '{"name":"'+ip+'","message":"'+message+'"}'; var data = '{"name":'+JSON.stringify(ip)+',"message":'+JSON.stringify(message)+'}';
$.ajax({ $.ajax({
type: 'POST', type: 'POST',
url: 'up/sendmessage', url: 'up/sendmessage',