Fixed bug #33289: ILIAS 7 XSS in erweiterter Sprachverwaltung (#4742)

* fixed XSS, added workaround to avoid stripping of non-html characters * changed workaround * changed workaround
ILIAS-eLearning · Jul 11, 2022 · 6906cbf · 6906cbf
1 parent a9eaad8
commit 6906cbf
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/Services/Language/classes/class.ilObjLanguageExtGUI.php b/Services/Language/classes/class.ilObjLanguageExtGUI.php
@@ -388,12 +388,13 @@ public function saveObject()
 
             // example key of variable: 'common#:#access'
             // example key of comment: 'common#:#access#:#comment'
-            $keys = explode($this->lng->separator, ilUtil::stripSlashes($key, false));
+            $keys = explode($this->lng->separator, ilUtil::stripSlashes($key));
 
             if (count($keys) == 2) {
                 // avoid line breaks
                 $value = preg_replace("/(\015\012)|(\015)|(\012)/", "<br />", $value);
-                $value = ilUtil::stripSlashes($value, false);
+                $value = str_replace("<<", "«",$value);
+                $value = ilUtil::stripSlashes($value);
                 $save_array[$key] = $value;
 
                 // the comment has the key of the language with the suffix