fix xss (#2060)

templates/activity/delete.html.twig

@@ -9,24 +9,22 @@
     {% set inUse = (stats.recordAmount > 0) %}
 
     {% set params = {
-        '%activity%': '<strong>' ~ activity.name ~ '</strong>',
-        '%project%': '<strong>-</strong>',
-        '%customer%': '<strong>-</strong>',
-        '%records%': '<strong>' ~ stats.recordAmount ~ '</strong>',
-        '%duration%': '<strong>' ~ stats.recordDuration|duration ~ '</strong>'
+        '%activity%': activity.name,
+        '%project%': '-',
+        '%customer%': '-',
+        '%records%': stats.recordAmount,
+        '%duration%': stats.recordDuration|duration
     } %}
 
     {% if activity.project is not null %}
         {% set params = params|merge({
-            '%project%': '<strong>' ~ activity.project.name ~ '</strong>',
-            '%customer%': '<strong>' ~ activity.project.customer.name ~ '</strong>',
+            '%project%': activity.project.name,
+            '%customer%': activity.project.customer.name,
         }) %}
     {% endif %}
 
-    {% set message = '<p>' ~ ("admin_activity.short_stats"|trans(params)|raw) ~ '</p><p>' ~ ("admin_entity.delete_confirm"|trans|raw) ~ '</p>' %}
-
     {{ include(app.request.xmlHttpRequest ? 'default/_form_delete_modal.html.twig' : 'default/_form_delete.html.twig', {
-        'message': message|raw,
+        'message': ("admin_activity.short_stats"|trans(params) ~ "admin_entity.delete_confirm"|trans),
         'form': form,
         'used': inUse,
         'back': path('admin_activity')

templates/activity/embed_budget.html.twig

@@ -4,11 +4,11 @@
     {% block box_attributes %}id="budget_box"{% endblock %}
     {% block box_body %}
         {% set params = {
-            '%activity%': '<strong>' ~ activity.name ~ '</strong>',
-            '%project%': '<strong>-</strong>',
-            '%customer%': '<strong>-</strong>',
-            '%records%': '<strong>' ~ stats.recordAmount ~ '</strong>',
-            '%duration%': '<strong>' ~ stats.recordDuration|duration ~ '</strong>'
+            '%activity%': activity.name,
+            '%project%': '-',
+            '%customer%': '-',
+            '%records%': stats.recordAmount,
+            '%duration%': stats.recordDuration|duration
         } %}
 
         {% set currency = null %}
@@ -18,17 +18,16 @@
 
         {% if activity.project is not null %}
             {% set params = params|merge({
-                '%project%': '<strong>' ~ activity.project.name ~ '</strong>',
-                '%customer%': '<strong>' ~ activity.project.customer.name ~ '</strong>',
+                '%project%': activity.project.name,
+                '%customer%': activity.project.customer.name,
             }) %}
         {% endif %}
 
         <p>
-            {{ 'admin_activity.short_stats'|trans(params)|raw }}
+            {{ 'admin_activity.short_stats'|trans(params) }}
             {{ 'label.rate_internal'|trans }}: {{ stats.recordInternalRate|money(currency) }}.
         </p>
 
-
         {{ progress.progressbar(activity.budget, stats.recordRate, 'label.budget'|trans, stats.recordRate|money(currency) ~ ' / ' ~ activity.budget|money(currency) ) }}
         {{ progress.progressbar(activity.timeBudget, stats.recordDuration, 'label.timeBudget'|trans, stats.recordDuration|duration ~ ' / ' ~ activity.timeBudget|duration ) }}
     {% endblock %}

templates/customer/delete.html.twig

@@ -9,17 +9,15 @@
     {% set inUse = (stats.recordAmount > 0) %}
 
     {% set params = {
-        '%activity%': '<strong>' ~ stats.activityAmount ~ '</strong>',
-        '%project%': '<strong>' ~ stats.projectAmount ~ '</strong>',
-        '%customer%': '<strong>' ~ customer.name ~ '</strong>',
-        '%records%': '<strong>' ~ stats.recordAmount ~ '</strong>',
-        '%duration%': '<strong>' ~ stats.recordDuration|duration ~ '</strong>'
+        '%activity%': stats.activityAmount,
+        '%project%': stats.projectAmount,
+        '%customer%': customer.name,
+        '%records%': stats.recordAmount,
+        '%duration%': stats.recordDuration|duration
     } %}
 
-    {% set message = '<p>' ~ ("admin_customer.short_stats"|trans(params)|raw) ~ '</p><p>' ~ ("admin_entity.delete_confirm"|trans|raw) ~ '</p>' %}
-
     {{ include(app.request.xmlHttpRequest ? 'default/_form_delete_modal.html.twig' : 'default/_form_delete.html.twig', {
-        'message': message|raw,
+        'message': ("admin_customer.short_stats"|trans(params) ~ "admin_entity.delete_confirm"|trans),
         'form': form,
         'used': inUse,
         'back': path('admin_customer')

templates/customer/embed_budget.html.twig

@@ -6,17 +6,17 @@
         {% set currency = customer.currency %}
 
         {% set params = {
-            '%activity%': '<strong>' ~ stats.activityAmount ~ '</strong>',
-            '%project%': '<strong>' ~ stats.projectAmount ~ '</strong>',
-            '%customer%': '<strong>' ~ customer.name ~ '</strong>',
-            '%records%': '<strong>' ~ stats.recordAmount ~ '</strong>',
-            '%duration%': '<strong>' ~ stats.recordDuration|duration ~ '</strong>',
-            '%rate%': '<strong>' ~ stats.recordRate|money(currency) ~ '</strong>',
-            '%internal_rate%': '<strong>' ~ stats.recordInternalRate|money(currency) ~ '</strong>'
+            '%activity%': stats.activityAmount,
+            '%project%': stats.projectAmount,
+            '%customer%': customer.name,
+            '%records%': stats.recordAmount,
+            '%duration%': stats.recordDuration|duration,
+            '%rate%': stats.recordRate|money(currency),
+            '%internal_rate%': stats.recordInternalRate|money(currency)
         } %}
 
         <p>
-            {{ 'admin_customer.short_stats'|trans(params)|raw }}
+            {{ 'admin_customer.short_stats'|trans(params) }}
             {{ 'label.rate_internal'|trans }}: {{ stats.recordInternalRate|money(currency) }}.
         </p>
 

templates/default/_form_delete.html.twig

@@ -13,7 +13,7 @@
                     {{ form_widget(form) }}
                 </div>
             {% else %}
-                <p>{{ message|raw }}</p>
+                <p>{{ message }}</p>
                 {{ form_widget(form) }}
             {% endif %}            
         {% endblock %}

templates/default/_form_delete_modal.html.twig

@@ -13,7 +13,7 @@
                 {{ form_widget(form) }}
             </div>
         {% else %}
-            <p>{{ message|raw }}</p>
+            <p>{{ message }}</p>
             {{ form_widget(form) }}
         {% endif %}
     {% endblock %}

templates/export/index.html.twig

@@ -116,7 +116,7 @@
                     </td>
                     <td class="{{ tables.data_table_column_class(tableName, columns, 'activity') }}">{{ widgets.label_activity(entry.activity) }}</td>
                     <td class="{{ tables.data_table_column_class(tableName, columns, 'description') }}">
-                        {{ entry.description|escape|desc2html }}
+                        {{ entry.description|desc2html }}
                     </td>
                     <td class="{{ tables.data_table_column_class(tableName, columns, 'unit_price') }}">
                         {{ rate|money(currency) }}

templates/export/pdf-layout.html.twig

@@ -263,7 +263,7 @@ mpdf-->
                     {{ entry.project.customer.name }} - {{ entry.project.name }}{% if entry.activity is not null %} - {{ entry.activity.name }}{% endif %}
                     {% if entry.description is not empty %}
                         <br>
-                        <i>{{ entry.description|escape|desc2html }}</i>
+                        <i>{{ entry.description|desc2html }}</i>
                     {% endif %}
                 </td>
                 <td class="duration">{{ entry.duration|duration(decimal) }}</td>

templates/export/renderer/default.html.twig

@@ -440,7 +440,7 @@
                         </td>
                         <td class="column-description" {% if not columns.description %}style="display: none"{% endif %}>
                             {% if entry.description is not empty %}
-                                {{ entry.description|escape|desc2html }}
+                                {{ entry.description|desc2html }}
                             {% endif %}
                         </td>
                         <td class="column-exported" {% if not columns.exported %}style="display: none"{% endif %}>

templates/invoice/index.html.twig

@@ -100,7 +100,7 @@
                     </td>
                     <td class="{{ tables.data_table_column_class(tableName, columns, 'description') }} timesheet-description">
                         {% if entry.description is not empty %}
-                            {{ entry.description|escape|desc2html }}
+                            {{ entry.description|desc2html }}
                         {% endif %}
                     </td>
                     <td class="{{ tables.data_table_column_class(tableName, columns, 'unit_price') }} text-center">{{ rate|money(currency) }}</td>

templates/invoice/renderer/default-pdf.pdf.twig

@@ -33,10 +33,10 @@
         <tr>
             <td>
                 <strong>{{ 'label.contact'|trans }}</strong>:
-                {{ model.template.contact|replace({"\n": ' &ndash; ', "\r\n": ' &ndash; ', "\r": ' &ndash; '})|raw }}
+                {{ model.template.contact|nl2str(' &ndash; ') }}
                 <br>
                 <strong>{{ 'label.invoice_bank_account'|trans }}</strong>:
-                {{ model.template.paymentDetails|replace({"\n": ' &ndash; ', "\r\n": ' &ndash; ', "\r": ' &ndash; '})|raw }}
+                {{ model.template.paymentDetails|nl2str(' &ndash; ') }}
             </td>
             <td align="right">
                 {{ 'export.page_of'|trans({'%page%': '{PAGENO}', '%pages%': '{nb}'}) }}
@@ -151,9 +151,9 @@ mpdf-->
     </table>
 
     {% if model.template.paymentTerms is not empty %}
-    <p>
+    <div class="paymentTerms">
         {{ model.template.paymentTerms|md2html }}
-    </p>
+    </div>
     {% endif %}
 </div>
 </body>

templates/invoice/renderer/default.html.twig

@@ -127,7 +127,7 @@
     <div class="col-xs-12">
         {% if model.template.paymentTerms is not empty %}
         <div contenteditable="true" class="paymentTerms">
-            {{ model.template.paymentTerms|nl2br|md2html }}
+            {{ model.template.paymentTerms|md2html }}
         </div>
         {% endif %}
     </div>
@@ -135,11 +135,11 @@
 
 <footer class="footer">
     <p>
-        <strong>{{ 'label.address'|trans }}</strong>: {{ model.template.company }} &ndash; {{ model.template.address|replace({"\n": ' &ndash; ', "\r\n": ' &ndash; ', "\r": ' &ndash; '})|raw }}
+        <strong>{{ 'label.address'|trans }}</strong>: {{ model.template.company }} &ndash; {{ model.template.address|nl2str(' &ndash; ') }}
         <br>
-        <strong>{{ 'label.invoice_bank_account'|trans }}</strong>: {{ model.template.paymentDetails|replace({"\n": ' &ndash; ', "\r\n": ' &ndash; ', "\r": ' &ndash; '})|raw }}
+        <strong>{{ 'label.invoice_bank_account'|trans }}</strong>: {{ model.template.paymentDetails|nl2str(' &ndash; ') }}
         <br>
-        <strong>{{ 'label.contact'|trans }}</strong>: {{ model.template.contact|replace({"\n": ' &ndash; ', "\r\n": ' &ndash; ', "\r": ' &ndash; '})|raw }}
+        <strong>{{ 'label.contact'|trans }}</strong>: {{ model.template.contact|nl2str(' &ndash; ') }}
     </p>
 </footer>
 {% endblock %}

templates/invoice/renderer/freelancer.html.twig

@@ -8,7 +8,7 @@
     <div class="col-xs-12">
         <header>
             <address>
-                <p contenteditable="true">{{ model.template.company }} &ndash; {{ model.template.address|replace({"\n": ' &ndash; ', "\r\n": ' &ndash; ', "\r": ' &ndash; '})|raw }}</p>
+                <p contenteditable="true">{{ model.template.company }} &ndash; {{ model.template.address|nl2str(' &ndash; ') }}</p>
             </address>
         </header>
         <article class="address">
@@ -108,7 +108,7 @@
         {% if model.template.paymentTerms is not empty %}
             <article class="paymentTerms">
                 <div contenteditable="true">
-                    {{ model.template.paymentTerms|nl2br|md2html }}
+                    {{ model.template.paymentTerms|md2html }}
                 </div>
             </article>
         {% endif %}

templates/project/delete.html.twig

@@ -9,17 +9,15 @@
     {% set inUse = (stats.recordAmount > 0) %}
 
     {% set params = {
-        '%project%': '<strong>' ~ project.name ~ '</strong>',
-        '%customer%': '<strong>' ~ project.customer.name ~ '</strong>',
-        '%records%': '<strong>' ~ stats.recordAmount ~ '</strong>',
-        '%activities%': '<strong>' ~ stats.activityAmount ~ '</strong>',
-        '%duration%': '<strong>' ~ stats.recordDuration|duration ~ '</strong>'
+        '%project%': project.name,
+        '%customer%': project.customer.name,
+        '%records%': stats.recordAmount,
+        '%activities%': stats.activityAmount,
+        '%duration%': stats.recordDuration|duration
     } %}
 
-    {% set message = '<p>' ~ ("admin_project.short_stats"|trans(params)|raw) ~ '</p><p>' ~ ("admin_entity.delete_confirm"|trans|raw) ~ '</p>' %}
-
     {{ include(app.request.xmlHttpRequest ? 'default/_form_delete_modal.html.twig' : 'default/_form_delete.html.twig', {
-        'message': message|raw,
+        'message': ("admin_project.short_stats"|trans(params) ~ "admin_entity.delete_confirm"|trans),
         'form': form,
         'used': inUse,
         'back': path('admin_project')

templates/project/embed_budget.html.twig

@@ -4,17 +4,17 @@
     {% block box_attributes %}id="budget_box"{% endblock %}
     {% block box_body %}
         {% set params = {
-            '%project%': '<strong>' ~ project.name ~ '</strong>',
-            '%customer%': '<strong>' ~ project.customer.name ~ '</strong>',
-            '%records%': '<strong>' ~ stats.recordAmount ~ '</strong>',
-            '%activities%': '<strong>' ~ stats.activityAmount ~ '</strong>',
-            '%duration%': '<strong>' ~ stats.recordDuration|duration ~ '</strong>'
+            '%project%': project.name,
+            '%customer%': project.customer.name,
+            '%records%': stats.recordAmount,
+            '%activities%': stats.activityAmount,
+            '%duration%': stats.recordDuration|duration
         } %}
 
         {% set currency = project.customer.currency %}
 
         <p>
-            {{ 'admin_project.short_stats'|trans(params)|raw }}
+            {{ 'admin_project.short_stats'|trans(params) }}
             {{ 'label.rate_internal'|trans }}: {{ stats.recordInternalRate|money(currency) }}.
         </p>
 

templates/project/index.html.twig

@@ -45,7 +45,7 @@
             <tr{% if is_granted('view', entry) %} class="alternative-link open-edit" data-href="{{ path('project_details', {'id': entry.id}) }}"{% endif %}>
                 <td class="{{ tables.data_table_column_class(tableName, columns, 'name') }}">{{ widgets.label_color_dot('project', true, entry.name, null, entry.color) }}</td>
                 <td class="{{ tables.data_table_column_class(tableName, columns, 'customer') }}">{{ widgets.label_customer(entry.customer) }}</td>
-                <td class="{{ tables.data_table_column_class(tableName, columns, 'comment') }}">{{ entry.comment|comment2html() }}</td>
+                <td class="{{ tables.data_table_column_class(tableName, columns, 'comment') }}">{{ entry.comment|comment2html }}</td>
                 <td class="{{ tables.data_table_column_class(tableName, columns, 'orderNumber') }}">{{ entry.orderNumber }}</td>
                 <td class="{{ tables.data_table_column_class(tableName, columns, 'orderDate') }}">{% if entry.orderDate is not null %}{{ entry.orderDate|date_full }}{% endif %}</td>
                 <td class="{{ tables.data_table_column_class(tableName, columns, 'start') }}">{% if entry.start is not null %}{{ entry.start|date_full }}{% endif %}</td>

templates/timesheet/export.html.twig

@@ -61,7 +61,7 @@
                         <td>
                             {% if entry.description is not empty %}
                                 <div>
-                                    {{ entry.description|escape|desc2html }}
+                                    {{ entry.description|desc2html }}
                                 </div>
                             {% endif %}
                             <span class="small">

templates/timesheet/layout-listing.html.twig

@@ -144,7 +144,7 @@
                 </td>
                 <td class="{{ tables.data_table_column_class(tableName, columns, 'description') }} timesheet-description">
                     {% if allowMarkdown %}
-                        {{ entry.description|escape|desc2html }}
+                        {{ entry.description|desc2html }}
                     {% else %}
                         {{ entry.description|nl2br }}
                     {% endif %}

templates/user/delete.html.twig

@@ -1,6 +1,5 @@
 {% extends app.request.xmlHttpRequest ? 'form.html.twig' : 'base.html.twig' %}
 {% import "macros/widgets.html.twig" as widgets %}
-{% import "macros/datatables.html.twig" as tables %}
 
 {% block page_title %}{{ 'admin_user.title'|trans }}{% endblock %}
 
@@ -9,15 +8,13 @@
     {% set inUse = (stats.recordsTotal > 0) %}
 
     {% set params = {
-        '%user%': '<strong>' ~ widgets.username(user) ~ '</strong>',
-        '%records%': '<strong>' ~ stats.recordsTotal ~ '</strong>',
-        '%duration%': '<strong>' ~ stats.durationTotal|duration ~ '</strong>'
+        '%user%': widgets.username(user),
+        '%records%': stats.recordsTotal,
+        '%duration%': stats.durationTotal|duration
     } %}
 
-    {% set message = '<p>' ~ ("admin_user.short_stats"|trans(params)|raw) ~ '</p>' %}
-
     {{ include(app.request.xmlHttpRequest ? 'default/_form_delete_modal.html.twig' : 'default/_form_delete.html.twig', {
-        'message': message|raw,
+        'message': "admin_user.short_stats"|trans(params),
         'form': form,
         'used': inUse,
         'back': path('admin_user')