mirror/Part-DB.Part-DB-server
1
0
Fork 1
mirror of https://github.com/Part-DB/Part-DB-server.git synced 2025-06-21 01:25:55 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fixed potential XSS injection vectors in datatables columns

Browse source
This commit is contained in:
Jan Böhmer 2023-02-26 01:23:36 +01:00
parent 5f39d8e594
commit 83cd91f1d1
6 changed files with 10 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/DataTables/Column/EntityColumn.php
View file

@ -79,7 +79,7 @@ class EntityColumn extends AbstractColumn
return sprintf(
'<a href="%s">%s</a>',
$this->urlGenerator->listPartsURL($entity),
$entity->getName()
htmlspecialchars($entity->getName())
);
}

2
src/DataTables/Column/SIUnitNumberColumn.php
View file

@ -50,6 +50,6 @@ class SIUnitNumberColumn extends AbstractColumn
return '';
}
return $this->formatter->format((float) $value, $this->options['unit'], $this->options['precision']);
return htmlspecialchars($this->formatter->format((float) $value, $this->options['unit'], $this->options['precision']));
}
}

8
src/DataTables/PartsDataTable.php
View file

@ -177,7 +177,7 @@ final class PartsDataTable implements DataTableTypeInterface
$tmp[] = sprintf(
'<a href="%s">%s</a>',
$this->urlGenerator->listPartsURL($lot->getStorageLocation()),
$lot->getStorageLocation()->getName()
htmlspecialchars($lot->getStorageLocation()->getName())
);
}
@ -192,13 +192,13 @@ final class PartsDataTable implements DataTableTypeInterface
$amount = $context->getAmountSum();
$expiredAmount = $context->getExpiredAmountSum();
$ret = $this->amountFormatter->format($amount, $context->getPartUnit());
$ret = htmlspecialchars($this->amountFormatter->format($amount, $context->getPartUnit()));
//If we have expired lots, we show them in parentheses behind
if ($expiredAmount > 0) {
$ret .= sprintf(' <span title="%s" class="text-muted">(+%s)</span>',
$this->translator->trans('part_lots.is_expired'),
$this->amountFormatter->format($expiredAmount, $context->getPartUnit()));
htmlspecialchars($this->amountFormatter->format($expiredAmount, $context->getPartUnit())));
}
@ -210,7 +210,7 @@ final class PartsDataTable implements DataTableTypeInterface
'label' => $this->translator->trans('part.table.minamount'),
'visible' => false,
'render' => function ($value, Part $context) {
return $this->amountFormatter->format($value, $context->getPartUnit());
return htmlspecialchars($this->amountFormatter->format($value, $context->getPartUnit()));
},
]);

4
src/DataTables/ProjectBomEntriesDataTable.php
View file

@ -84,7 +84,7 @@ class ProjectBomEntriesDataTable implements DataTableTypeInterface
return round($context->getQuantity());
}
//Otherwise use the unit of the part to format the quantity
return $this->amountFormatter->format($context->getQuantity(), $context->getPart()->getPartUnit());
return htmlspecialchars($this->amountFormatter->format($context->getQuantity(), $context->getPart()->getPartUnit()));
},
])
@ -93,7 +93,7 @@ class ProjectBomEntriesDataTable implements DataTableTypeInterface
'orderable' => false,
'render' => function ($value, ProjectBOMEntry $context) {
if($context->getPart() === null) {
return $context->getName();
return htmlspecialchars($context->getName());
}
if($context->getPart() !== null) {
$tmp = $this->partDataTableHelper->renderName($context->getPart());

2
src/Services/ElementTypeNameGenerator.php
View file

@ -117,7 +117,7 @@ class ElementTypeNameGenerator
* It uses getLocalizedLabel to determine the type.
*
* @param NamedElementInterface $entity the entity for which the string should be generated
* @param bool $use_html If set to true, a html string is returned, where the type is set italic
* @param bool $use_html If set to true, a html string is returned, where the type is set italic, and the name is escaped
*
* @return string The localized string
*

2
src/Services/LogSystem/LogEntryExtraFormatter.php
View file

@ -193,7 +193,7 @@ class LogEntryExtraFormatter
}
if ($context->getInstockChangeType() === PartStockChangedLogEntry::TYPE_MOVE) {
$array['log.part_stock_changed.move_target'] =
$this->elementTypeNameGenerator->getLocalizedTypeLabel(PartLot::class)
htmlspecialchars($this->elementTypeNameGenerator->getLocalizedTypeLabel(PartLot::class))
.' ' . $context->getMoveToTargetID();
}
}