composer/iTop
6
0
Fork 0
mirror of https://github.com/Combodo/iTop.git synced 2026-05-19 15:22:17 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/support/2.7' into develop

Browse Source
This commit is contained in:
Pierre Goiffon
2020-10-12 12:49:17 +02:00
parent eb3ad0999a 2d130cbba8
commit 72fc22c49a
2 changed files with 14 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
js/breadcrumb.js
View File

@@ -69,8 +69,8 @@ $(function()
if (sTitle.length == 0) { if (sTitle.length == 0) {
sTitle = oEntry['label']; sTitle = oEntry['label'];
} }
sTitle = SanitizeHtml(sTitle); sTitle = SanitizeHtml(sTitle, false);
sLabel = SanitizeHtml(sLabel); sLabel = SanitizeHtml(sLabel, false);
if ((this.options.new_entry !== null) && (iEntry == aBreadCrumb.length-1)) { if ((this.options.new_entry !== null) && (iEntry == aBreadCrumb.length-1)) {
// Last entry is the current page // Last entry is the current page

16
js/utils.js
View File

@@ -681,19 +681,27 @@ function DisplayHistory(sSelector, sFilter, iCount, iStart) {
/** /**
* @param sValue value to escape * @param sValue value to escape
* @param bReplaceAmp if false don't replace "&" (can be useful when dealing with html entities)
* @returns {string} sanitized value, ready to insert in the DOM without XSS risk * @returns {string} sanitized value, ready to insert in the DOM without XSS risk
* *
* @since 2.6.5, 2.7.2, 2.8.0 N°3332 * @since 2.6.5, 2.7.2, 3.0.0 N°3332
* @see https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#rule-1-html-encode-before-inserting-untrusted-data-into-html-element-content * @see https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#rule-1-html-encode-before-inserting-untrusted-data-into-html-element-content
* @see https://stackoverflow.com/questions/295566/sanitize-rewrite-html-on-the-client-side/430240#430240 why inserting in the DOM (for
* example the text() JQuery way) isn't safe
*/ */
function SanitizeHtml(sValue) { function SanitizeHtml(sValue, bReplaceAmp) {
return (sValue+'') var sSanitizedValue = (sValue+'')
.replace(/&/g, '&')
.replace(/</g, '&lt;') .replace(/</g, '&lt;')
.replace(/>/g, '&gt;') .replace(/>/g, '&gt;')
.replace(/"/g, '&quot;') .replace(/"/g, '&quot;')
.replace(/'/g, '&#x27;') .replace(/'/g, '&#x27;')
.replace(/\//g, '&#x2F;'); .replace(/\//g, '&#x2F;');
if (bReplaceAmp) {
sSanitizedValue = sSanitizedValue.replace(/&/g, '&amp;');
}
return sSanitizedValue;
} }
// Very simple equivalent to format: placeholders are %1$s %2$d ... // Very simple equivalent to format: placeholders are %1$s %2$d ...