mirror/Part-DB.Part-DB-server
1
0
Fork 1
mirror of https://github.com/Part-DB/Part-DB-server.git synced 2025-08-03 17:55:03 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Properly escape user provided data in trans with data to prevent possible XSS attack vectors.

Browse source
This commit is contained in:
Jan Böhmer 2023-02-26 00:41:08 +01:00
parent 5b7f44f4ea
commit 6ff60e556e
3 changed files with 4 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

4
templates/parts/edit/edit_part_info.html.twig
View file

@ -1,12 +1,12 @@
{% extends "main_card.html.twig" %}
{% block title %}
{% trans with {'%name%': part.name} %}part.edit.title{% endtrans %}
{% trans with {'%name%': part.name|escape } %}part.edit.title{% endtrans %}
{% endblock %}
{% block card_title %}
<i class="fas fa-edit fa-fw" aria-hidden="true"></i>
{% trans with {'%name%': part.name} %}part.edit.card_title{% endtrans %}
{% trans with {'%name%': part.name|escape } %}part.edit.card_title{% endtrans %}
<b><a href="{{ entity_url(part, 'info') }}" class="text-white">{{ part.name }}</a></b>
<div class="float-end">
{% trans %}id.label{% endtrans %}: {{ part.id }} {% if part.ipn is not empty %}(<i>{{ part.ipn }}</i>){% endif %}