diff options
| author |  Inverle <inverle@proton.me>
| 2025-07-07 23:32:35 +0200 |
|---|---|---|
| committer |  GitHub <noreply@github.com>
| 2025-07-07 23:32:35 +0200 |
| commit | 6549932d59aef3b72a9da29294af0f30ffb77af5 (patch) | |
| tree | e116708c29d14232295a0d7994dd24c9f977b437 /app/Controllers/configureController.php | |
| parent | ce22997dfbe4a8f2a6efa6f77d5b0bfc7b2dabd1 (diff) | |
Disallow setting non-existent theme (#7722)
Related: https://github.com/FreshRSS/xExtension-Demo/pull/2, https://github.com/FreshRSS/FreshRSS/pull/7559#issuecomment-2858083635
Mostly to make sure that no one is able to break the demo instance
But the issues below could possibly be exploited in other scenarios too:
* Setting a theme like `../../lib/core-extensions/UserJS`: this directory contains `metadata.json` like themes do, so FreshRSS treats it as a theme after setting it and doesn't load any CSS
* Setting a theme like `x dropdown-menu`: the `dropdown-menu` class was able to get injected into the `<body>` element since https://github.com/FreshRSS/FreshRSS/pull/7559 and turn every page blank
Diffstat (limited to 'app/Controllers/configureController.php')
| -rw-r--r-- | app/Controllers/configureController.php | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/app/Controllers/configureController.php b/app/Controllers/configureController.php index 59845d710..edd04a64c 100644 --- a/app/Controllers/configureController.php +++ b/app/Controllers/configureController.php @@ -47,7 +47,10 @@ class FreshRSS_configure_Controller extends FreshRSS_ActionController { if (Minz_Request::isPost()) { FreshRSS_Context::userConf()->language = Minz_Request::paramString('language') ?: 'en'; FreshRSS_Context::userConf()->timezone = Minz_Request::paramString('timezone'); - FreshRSS_Context::userConf()->theme = Minz_Request::paramString('theme') ?: FreshRSS_Themes::$defaultTheme; + $theme = Minz_Request::paramString('theme') ?: FreshRSS_Themes::$defaultTheme; + if (FreshRSS_Themes::exists($theme)) { + FreshRSS_Context::userConf()->theme = $theme; + } FreshRSS_Context::userConf()->darkMode = Minz_Request::paramString('darkMode') ?: 'auto'; FreshRSS_Context::userConf()->content_width = Minz_Request::paramString('content_width') ?: 'thin'; FreshRSS_Context::userConf()->topline_read = Minz_Request::paramBoolean('topline_read'); |