composer/iTop
6
0
Fork 0
mirror of https://github.com/Combodo/iTop.git synced 2026-04-24 02:58:43 +02:00
Code Issues Packages Projects Releases Wiki Activity

N°7514 - hardening code

Browse Source 
(cherry picked from commit b8b9423aa85c65b25f7fb3d9c5ba0933317474d7)
This commit is contained in:
Eric Espie
2024-06-18 17:40:20 +02:00
parent f63abd9b6f
commit 2804076bf6
4 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
datamodels/2.x/itop-portal-base/portal/public/js/portal_form_field.js
View File

@@ -35,7 +35,8 @@ $(function()
me.element.addClass('has-error'); me.element.addClass('has-error');
for(var i in oResult.error_messages) for(var i in oResult.error_messages)
{ {
me.element.find('.help-block').append($('<p>' + oResult.error_messages[i] + '</p>')); // transform error message in pure text to avoid XSS
me.element.find('.help-block').append($('<p>').text(oResult.error_messages[i]));
} }
} }
} }

3
datamodels/2.x/itop-portal-base/portal/public/js/portal_form_handler.js
View File

@@ -252,7 +252,8 @@ $(function()
} }
else else
{ {
oHelpBlock.append($('<p>' + sMessageContent + '</p>')); // transform error message in pure text (to avoid XSS)
oHelpBlock.append($('<p>').text(sMessageContent));
} }
} }
} }

1
sources/Form/Validator/MultipleChoicesValidator.php
View File

@@ -53,7 +53,6 @@ class MultipleChoicesValidator extends AbstractValidator
private function CheckValueAgainstChoices(string $sValue, array &$aErrorMessages): void private function CheckValueAgainstChoices(string $sValue, array &$aErrorMessages): void
{ {
if (false === array_key_exists($sValue, $this->aChoices)) { if (false === array_key_exists($sValue, $this->aChoices)) {
$sValue = utils::HtmlEntities($sValue);
$aErrorMessages[] = "Value ({$sValue}) is not part of the field possible values list"; $aErrorMessages[] = "Value ({$sValue}) is not part of the field possible values list";
} }
} }

1
sources/Form/Validator/SelectObjectValidator.php
View File

@@ -37,7 +37,6 @@ class SelectObjectValidator extends AbstractValidator
$iObjectsCount = $oSetForExistingCurrentValue->CountWithLimit(1); $iObjectsCount = $oSetForExistingCurrentValue->CountWithLimit(1);
if ($iObjectsCount === 0) { if ($iObjectsCount === 0) {
$value = utils::HtmlEntities($value);
return ["Value $value does not match the corresponding filter set"]; return ["Value $value does not match the corresponding filter set"];
} }