hazza/Phraseanet
1
0
Fork 0
mirror of https://github.com/alchemy-fr/Phraseanet.git synced 2025-10-17 15:03:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

PHRAS-3800_xss (#4219)

Browse Source 
* add encode option to record::get_title ; render preview.record_title in twig

* html-escape facet values
This commit is contained in:
jygaulier
2023-03-15 11:05:34 +01:00
committed by GitHub
parent 32ff2739ab
commit e7027c7220
31 changed files with 241 additions and 158 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
lib/Alchemy/Phrasea/Model/Repositories/StoryWZRepository.php
View File

@@ -15,6 +15,7 @@ use Alchemy\Phrasea\Application;
use Alchemy\Phrasea\Model\Entities\StoryWZ;
use Alchemy\Phrasea\Model\Entities\User;
use Doctrine\ORM\EntityRepository;
use record_adapter;
use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
@@ -79,7 +80,7 @@ class StoryWZRepository extends EntityRepository
if ($story) {
try {
$story->getRecord($app)->get_title();
$story->getRecord($app)->get_title(['encode'=> record_adapter::ENCODE_NONE]);
} catch (NotFoundHttpException $e) {
$this->getEntityManager()->remove($story);
throw new NotFoundHttpException('Story not found');
@@ -95,7 +96,7 @@ class StoryWZRepository extends EntityRepository
return $story;
}
public function findUserStory(Application $app, User $user, \record_adapter $Story)
public function findUserStory(Application $app, User $user, record_adapter $Story)
{
$story = $this->findOneBy([
'user' => $user->getId(),
@@ -118,10 +119,10 @@ class StoryWZRepository extends EntityRepository
/**
* @param Application $app
* @param \record_adapter $Story
* @param record_adapter $Story
* @return StoryWZ[]
*/
public function findByRecord(Application $app, \record_adapter $Story)
public function findByRecord(Application $app, record_adapter $Story)
{
$dql = 'SELECT s FROM Phraseanet:StoryWZ s
WHERE s.sbas_id = :sbas_id