hazza/Phraseanet
1
0
Fork 0
mirror of https://github.com/alchemy-fr/Phraseanet.git synced 2025-10-10 19:43:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

PHRAS-3800_xss (#4219)

Browse Source 
* add encode option to record::get_title ; render preview.record_title in twig

* html-escape facet values
This commit is contained in:
jygaulier
2023-03-15 11:05:34 +01:00
committed by GitHub
parent 32ff2739ab
commit e7027c7220
31 changed files with 241 additions and 158 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
lib/classes/set/export.php
View File

@@ -138,7 +138,7 @@ class set_export extends set_abstract
$app,
$child_basrec->getDataboxId(),
$record_id,
$record->get_title(['removeExtension' => true]) . '_' . $n,
$record->get_title(['removeExtension' => true, 'encode'=> record_adapter::ENCODE_NONE]) . '_' . $n,
$remain_hd[$base_id]
);
$this->add_element($current_element);
@@ -467,7 +467,7 @@ class set_export extends set_abstract
//
if ($rename_title) {
// use the title (may be a concat of fields)
$export_name = strip_tags($download_element->get_title(['removeExtension' => true]));
$export_name = strip_tags($download_element->get_title(['removeExtension' => true, 'encode'=> record_adapter::ENCODE_FOR_URI]));
// if the "title" ends up with a "filename-like" field, remove extension
if (strtolower(substr($export_name, -strlen($extension)-1)) === '.'.strtolower($extension)) {
$export_name = substr($export_name, 0, strlen($export_name)-1-strlen($extension));