From c653131baa10925544cbfa6fe871b7d31646efef Mon Sep 17 00:00:00 2001 From: Andy Miller Date: Tue, 23 Oct 2018 08:35:13 -0600 Subject: [PATCH] Fix XSS checking when empty content #1533 --- CHANGELOG.md | 1 + classes/admincontroller.php | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 73316692..d240532b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -44,6 +44,7 @@ * Fixed file extension detection * Fix for HTML entities in page slug [#1524](https://github.com/getgrav/grav-plugin-admin/issues/1524) * Fix for port in backup download links [#1521](https://github.com/getgrav/grav-plugin-admin/issues/1521) + * Fix XSS checking when empty content [#1533](https://github.com/getgrav/grav-plugin-admin/issues/1533) # v1.8.10 ## 10/01/2018 diff --git a/classes/admincontroller.php b/classes/admincontroller.php index 3c905901..132f03a8 100644 --- a/classes/admincontroller.php +++ b/classes/admincontroller.php @@ -658,7 +658,7 @@ class AdminController extends AdminBaseController // XSS Checks for page content $xss_whitelist = $this->grav['config']->get('security.xss_whitelist', 'admin.super'); if (!$this->admin->authorize($xss_whitelist)) { - $check_what = ['header' => $data['header'], 'content' => $data['content']]; + $check_what = ['header' => $data['header'], 'content' => isset($data['content']) ? $data['content'] : '']; $results = Security::detectXssFromArray($check_what); if (!empty($results)) { $this->admin->setMessage(' ' . $this->admin->translate('PLUGIN_ADMIN.XSS_ONSAVE_ISSUE'),