CVE-2019-8349 XSS vulnerabilities fix

config/config.ini

@@ -1,147 +0,0 @@
-; The URL of your blog. Include the http or https if you are using Facebook or Disqus comment. 
-site.url = ""
-
-; Your timezone
-timezone = "Asia/Jakarta"
-
-; Your language ("en" for English, "de" for German, "pl" for Polish)
-language = "en"
-
-; Blog info
-blog.title = "HTMLy"
-blog.tagline = "Just another HTMLy blog"
-blog.description = "Proudly powered by HTMLy, a databaseless blogging platform."
-blog.copyright = "(c) Your name."
-
-; Set permalink type. "default" using /year/month/title. "post" using /post/title
-permalink.type = "default"
-
-; Make the frontpage static. Options "false" and "true"
-static.frontpage = "false"
-
-; Show the /blog url as the blog homepage. Options "false" and "true"
-blog.enable = "false"
-
-; Social account
-social.twitter = "https://twitter.com"
-social.facebook = "https://www.facebook.com"
-social.google = "https://plus.google.com"
-social.tumblr = "http://www.tumblr.com"
-
-; Custom menu link. 
-; See example below:
-; "Google->http://www.google.com|Wikipedia->http://www.wikipedia.org". 
-blog.menu = ""
-
-; Breadcrumb home text. Useful when installed on subfolder.
-breadcrumb.home = "Home"
-
-; Comment system. Choose "facebook", "disqus", or "disable".
-comment.system = "disable"
-
-; Facebook comments
-fb.appid = ""
-fb.num = "5"
-fb.color = "light"
-
-; Disqus comments
-disqus.shortname = ""
-
-; Google Web Master Tool ID verification
-google.wmt.id = ""
-
-; Google+ publisher
-google.publisher = ""
-
-; Google analytics
-google.analytics.id = ""
-
-; Google reCaptcha
-; https://www.google.com/recaptcha/admin. Options "false" and "true"
-
-google.reCaptcha = "false"
-google.reCaptcha.public = ""
-google.reCaptcha.private = ""
-
-; Pagination, RSS, and JSON
-posts.perpage = "10"
-category.perpage = "10"
-tag.perpage = "10"
-archive.perpage = "10"
-search.perpage = "10"
-profile.perpage = "10"
-type.perpage = "10"
-json.count = "10"
-
-; Category info
-category.info = "true"
-
-; Related posts
-related.count = "3"
-
-; Recent posts
-recent.count = "5"
-
-; Popular posts
-popular.count = "5"
-
-; Author info on blog post. Set "true" or "false".
-author.info = "true"
-
-; Teaser type: set "trimmed" or "full".
-teaser.type = "full"
-
-; Read more link text for "full" teaser type
-read.more = "Read more"
-
-; Teaser character count
-teaser.char = "200"
-
-; Description character count
-description.char = "150"
-
-; RSS feed count
-rss.count = "10"
-
-; RSS feed description length. If left empty we will use full page.
-rss.char = "200"
-
-; Enable image thumbnail on teaser, the options is "true" and "false". If set to "true", you can specify the default thumbnail also.
-img.thumbnail = "false"
-default.thumbnail = ""
-
-; Enable views Counter, the options is "true" and "false". If set to "true", you can see the Counts in Admin page and popular posts.
-views.counter = "false"
-
-; Sitemap priorities between "0.0" and "1.0". Set "false" to disable a sitemap for the given type. (See /sitemap.xml)
-sitemap.priority.base = "1.0"
-sitemap.priority.post = "0.5"
-sitemap.priority.static = "0.5"
-sitemap.priority.category = "0.5"
-sitemap.priority.tag = "0.5"
-sitemap.priority.archiveDay = "0.5"
-sitemap.priority.archiveMonth = "0.5"
-sitemap.priority.archiveYear = "0.5"
-sitemap.priority.author = "0.5"
-sitemap.priority.type = "0.5"
-
-; Also install pre-release
-prerelease = "false"
-
-; Cache expiration in hour. Eg. "6", "12". Default 6 hours.
-cache.expiration = "6"
-
-; Switch on and off the file cache for development purposes. Options "false" and "true"
-cache.off = "false"
-
-; Switch on and off the page generation time. Options "false" and "true"
-generation.time = "false"
-
-; Switch on and off the cache timestamp. Options "false" and "true"
-cache.timestamp = "false"
-
-; Set the theme here
-views.root = "themes/twentysixteen"
-
-; Framework config. No need to edit.
-views.layout = "layout"

config/config.ini.example

@@ -4,6 +4,9 @@ site.url = ""
 ; Your timezone
 timezone = "Asia/Jakarta"
 
+; Time format. See: https://www.php.net/manual/en/function.date.php
+time.format = "d F Y"
+
 ; Your language (currently only "en" for English or "de" for German)
 language = "en"
 
@@ -25,7 +28,6 @@ blog.enable = "false"
 ; Social account
 social.twitter = "https://twitter.com"
 social.facebook = "https://www.facebook.com"
-social.google = "https://plus.google.com"
 social.tumblr = "http://www.tumblr.com"
 
 ; Custom menu link. 

config/users/kanti.ini

@@ -1,9 +0,0 @@
-;Password
-password = yourpassword
-encryption = clear
-; encryption: not set, leave blank or set to clear or none to use plain text password for the user,
-; else set to encryption algoritm supported by hash function of php to use the selected
-; encryption
-
-;Role
-role = admin