diff --git a/lib/SP/Html/Html.php b/lib/SP/Html/Html.php index 172e7f1e4..b47547887 100644 --- a/lib/SP/Html/Html.php +++ b/lib/SP/Html/Html.php @@ -191,12 +191,12 @@ public static function getSafeUrl(string $url): string } return preg_replace_callback( - '/[^:\/@?&=#%\w]+/u', + '/["<>\']+/u', function ($matches) { return urlencode($matches[0]); }, - $url + strip_tags($url) ); } } diff --git a/lib/SP/Services/Install/Installer.php b/lib/SP/Services/Install/Installer.php index abc8a665a..2080f482e 100644 --- a/lib/SP/Services/Install/Installer.php +++ b/lib/SP/Services/Install/Installer.php @@ -60,9 +60,9 @@ final class Installer extends Service /** * sysPass' version and build number */ - const VERSION = [3, 2, 10]; + const VERSION = [3, 2, 11]; const VERSION_TEXT = '3.2'; - const BUILD = 22070101; + const BUILD = 22070201; /** * @var DatabaseSetupInterface diff --git a/tests/SP/Html/HtmlTest.php b/tests/SP/Html/HtmlTest.php index 16f0cd639..5723c97a0 100644 --- a/tests/SP/Html/HtmlTest.php +++ b/tests/SP/Html/HtmlTest.php @@ -56,7 +56,7 @@ public function testGetSafeUrlOk() */ public function testGetSafeUrlEncoded(string $url) { - $this->assertEquals(0, preg_match('/["<>]+/', Html::getSafeUrl($url))); + $this->assertEquals(0, preg_match('/["<>\']+/', Html::getSafeUrl($url))); } private function urlProvider(): array @@ -67,6 +67,7 @@ private function urlProvider(): array ['https://foo.com/">'], ['https://foo.com/"%20onClick="alert(\'TEST\'")'], ['https://foo.com/" onClick="alert(\'TEST\')"'], + ['mongodb+srv://cluster.foo.mongodb.net/bar'], ]; } }