From 4668e8a9541328139ebefea3e463a68b6f6a99f1 Mon Sep 17 00:00:00 2001 From: aina-esokia Date: Thu, 22 Nov 2018 14:16:31 +0400 Subject: [PATCH 01/21] fix escape lightbox --- templates/web/lightbox/index.html.twig | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/templates/web/lightbox/index.html.twig b/templates/web/lightbox/index.html.twig index 9ff76249e1..70fb42608b 100644 --- a/templates/web/lightbox/index.html.twig +++ b/templates/web/lightbox/index.html.twig @@ -51,7 +51,7 @@

- {{basket.getName()|raw}} + {{basket.getName()|e}}

{% if basket.getValidation().isFinished() %} {{ '(validation) session terminee' | trans }} @@ -116,7 +116,7 @@

- {{ basket.getName()|raw}} + {{ basket.getName()|e}}

From 06e30750e4006c535aad0c016ecb3f6ec6569ea7 Mon Sep 17 00:00:00 2001 From: aina-esokia Date: Thu, 22 Nov 2018 14:21:12 +0400 Subject: [PATCH 02/21] fix escape in admin connected-user --- templates/web/admin/connected-users.html.twig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/web/admin/connected-users.html.twig b/templates/web/admin/connected-users.html.twig index 9477e20edf..4b784a385f 100644 --- a/templates/web/admin/connected-users.html.twig +++ b/templates/web/admin/connected-users.html.twig @@ -94,7 +94,7 @@ {% for session in data['sessions'] %} {% set row = session['session'] %} - + {% if row.getId() == app['session'].get('session_id') %} {{ row.getUser().getDisplayName() }} From c58ed453334a0dd5ae4bd5d0a23a85e65ca36dc2 Mon Sep 17 00:00:00 2001 From: aina-esokia Date: Thu, 22 Nov 2018 14:32:42 +0400 Subject: [PATCH 03/21] fix prod escaping --- lib/Alchemy/Phrasea/Controller/Prod/PushController.php | 2 +- lib/classes/record/adapter.php | 2 +- lib/classes/record/preview.php | 4 ++-- templates/web/prod/WorkZone/Macros.html.twig | 4 ++-- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/lib/Alchemy/Phrasea/Controller/Prod/PushController.php b/lib/Alchemy/Phrasea/Controller/Prod/PushController.php index 569537fed3..35b3a3bc42 100644 --- a/lib/Alchemy/Phrasea/Controller/Prod/PushController.php +++ b/lib/Alchemy/Phrasea/Controller/Prod/PushController.php @@ -597,7 +597,7 @@ class PushController extends Controller private function formatUser(User $user) { - $subtitle = array_filter([$user->getJob(), $user->getCompany()]); + $subtitle = array_filter([htmlspecialchars($user->getJob()), htmlspecialchars($user->getCompany())]); return [ 'type' => 'USER', diff --git a/lib/classes/record/adapter.php b/lib/classes/record/adapter.php index e49904424a..37320f64a3 100644 --- a/lib/classes/record/adapter.php +++ b/lib/classes/record/adapter.php @@ -939,7 +939,7 @@ class record_adapter implements RecordInterface, cache_cacheableInterface $this->set_data_to_cache(self::CACHE_TITLE, $title); } - return $title; + return htmlspecialchars($title); } /** diff --git a/lib/classes/record/preview.php b/lib/classes/record/preview.php index dd0ae0fe43..1c88f6e94e 100644 --- a/lib/classes/record/preview.php +++ b/lib/classes/record/preview.php @@ -149,7 +149,7 @@ class record_preview extends record_adapter $this->original_item = $element; $sbas_id = $element->getSbasId(); $record_id = $element->getRecordId(); - $this->name = $Basket->getName(); + $this->name = htmlspecialchars($Basket->getName()); $number = $element->getOrd(); $first = false; } @@ -169,7 +169,7 @@ class record_preview extends record_adapter if ($element->getOrd() == $pos || $first) { $sbas_id = $element->getSbasId(); $record_id = $element->getRecordId(); - $this->name = $entry->getTitle(); + $this->name = htmlspecialchars($entry->getTitle()); $this->original_item = $element; $number = $element->getOrd(); $first = false; diff --git a/templates/web/prod/WorkZone/Macros.html.twig b/templates/web/prod/WorkZone/Macros.html.twig index 04f3d3d735..7aa678ba6b 100644 --- a/templates/web/prod/WorkZone/Macros.html.twig +++ b/templates/web/prod/WorkZone/Macros.html.twig @@ -19,7 +19,7 @@ {% endif %} - {{basket.getName()}} + {{basket.getName()|e}}