Unverified Commit 626e58cc authored by John McLear's avatar John McLear Committed by GitHub
Browse files

Merge pull request #3314 from rhelmer/sanitize-jsonp

better sanitize jsonp
parents d7c93b0c f56936c9
......@@ -18,7 +18,7 @@ var apiCaller = function(req, res, fields) {
apiLogger.info("RESPONSE, " + req.params.func + ", " + response);
//is this a jsonp call, if yes, add the function call
if(req.query.jsonp)
if(req.query.jsonp && isVarName(response))
response = req.query.jsonp + "(" + response + ")";
res._____send(response);
......
......@@ -43,7 +43,8 @@
"jsonminify" : "0.4.1",
"measured" : "1.1.0",
"mocha" : "2.4.5",
"supertest" : "1.2.0"
"supertest" : "1.2.0",
"is-var-name" : "1.0.0"
},
"bin": { "etherpad-lite": "./node/server.js" },
"devDependencies": {
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment