jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

fix xss (#2060)

Browse Source
This commit is contained in:
Kevin Papst
2020-10-26 11:35:31 +01:00
committed by GitHub
parent 7ae55c1980
commit 6db21d7b34
28 changed files with 157 additions and 91 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
templates/invoice/renderer/default.html.twig
View File

@@ -127,7 +127,7 @@
<div class="col-xs-12">
{% if model.template.paymentTerms is not empty %}
<div contenteditable="true" class="paymentTerms">
{{ model.template.paymentTerms|nl2br|md2html }}
{{ model.template.paymentTerms|md2html }}
</div>
{% endif %}
</div>
@@ -135,11 +135,11 @@
<footer class="footer">
<p>
<strong>{{ 'label.address'|trans }}</strong>: {{ model.template.company }} &ndash; {{ model.template.address|replace({"\n": ' &ndash; ', "\r\n": ' &ndash; ', "\r": ' &ndash; '})|raw }}
<strong>{{ 'label.address'|trans }}</strong>: {{ model.template.company }} &ndash; {{ model.template.address|nl2str(' &ndash; ') }}
<br>
<strong>{{ 'label.invoice_bank_account'|trans }}</strong>: {{ model.template.paymentDetails|replace({"\n": ' &ndash; ', "\r\n": ' &ndash; ', "\r": ' &ndash; '})|raw }}
<strong>{{ 'label.invoice_bank_account'|trans }}</strong>: {{ model.template.paymentDetails|nl2str(' &ndash; ') }}
<br>
<strong>{{ 'label.contact'|trans }}</strong>: {{ model.template.contact|replace({"\n": ' &ndash; ', "\r\n": ' &ndash; ', "\r": ' &ndash; '})|raw }}
<strong>{{ 'label.contact'|trans }}</strong>: {{ model.template.contact|nl2str(' &ndash; ') }}
</p>
</footer>
{% endblock %}