mirror/Part-DB.Part-DB-server
1
0
Fork 1
mirror of https://github.com/Part-DB/Part-DB-server.git synced 2025-06-20 17:15:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Properly escape user provided data in trans with data to prevent possible XSS attack vectors.

Browse source
This commit is contained in:
Jan Böhmer 2023-02-26 00:41:08 +01:00
parent 5b7f44f4ea
commit 6ff60e556e
3 changed files with 4 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

2
templates/admin/base_admin.html.twig
View file

@ -37,7 +37,7 @@
<fieldset> <fieldset>
<legend> <legend>
{% if entity.ID %} {% if entity.ID %}
<strong>{% block edit_title %}{% trans with {'%name': entity.name} %}edit.caption{% endtrans %}{% endblock %}</strong> <strong>{% block edit_title %}{% trans with {'%name': entity.name|escape } %}edit.caption{% endtrans %}{% endblock %}</strong>
{% if timeTravel is defined and timeTravel is not null %} {% if timeTravel is defined and timeTravel is not null %}
({{ timeTravel|format_datetime('short') }}) ({{ timeTravel|format_datetime('short') }})
{% endif %} {% endif %}

2
templates/mail/pw_reset.html.twig
View file

@ -3,7 +3,7 @@
{% block content %} {% block content %}
<row> <row>
<columns> <columns>
<h4>{% trans with {'%name%': user.fullName} %}email.hi %name%{% endtrans %},</h4> <h4>{% trans with {'%name%': user.fullName|escape } %}email.hi %name%{% endtrans %},</h4>
{% trans %}email.pw_reset.message{% endtrans %} {% trans %}email.pw_reset.message{% endtrans %}
<br> <br>
<button class="large expand" href="{{ url('pw_reset_new_pw', {user: user.name, token: token}) }}">{% trans %}email.pw_reset.button{% endtrans %}</button> <button class="large expand" href="{{ url('pw_reset_new_pw', {user: user.name, token: token}) }}">{% trans %}email.pw_reset.button{% endtrans %}</button>

4
templates/parts/edit/edit_part_info.html.twig
View file

@ -1,12 +1,12 @@
{% extends "main_card.html.twig" %} {% extends "main_card.html.twig" %}
{% block title %} {% block title %}
{% trans with {'%name%': part.name} %}part.edit.title{% endtrans %} {% trans with {'%name%': part.name|escape } %}part.edit.title{% endtrans %}
{% endblock %} {% endblock %}
{% block card_title %} {% block card_title %}
<i class="fas fa-edit fa-fw" aria-hidden="true"></i> <i class="fas fa-edit fa-fw" aria-hidden="true"></i>
{% trans with {'%name%': part.name} %}part.edit.card_title{% endtrans %} {% trans with {'%name%': part.name|escape } %}part.edit.card_title{% endtrans %}
<b><a href="{{ entity_url(part, 'info') }}" class="text-white">{{ part.name }}</a></b> <b><a href="{{ entity_url(part, 'info') }}" class="text-white">{{ part.name }}</a></b>
<div class="float-end"> <div class="float-end">
{% trans %}id.label{% endtrans %}: {{ part.id }} {% if part.ipn is not empty %}(<i>{{ part.ipn }}</i>){% endif %} {% trans %}id.label{% endtrans %}: {{ part.id }} {% if part.ipn is not empty %}(<i>{{ part.ipn }}</i>){% endif %}