jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

fix xss (#2060)

Browse Source
This commit is contained in:
Kevin Papst
2020-10-26 11:35:31 +01:00
committed by GitHub
parent 7ae55c1980
commit 6db21d7b34
28 changed files with 157 additions and 91 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
templates/activity/delete.html.twig
View File

@@ -9,24 +9,22 @@
{% set inUse = (stats.recordAmount > 0) %}
{% set params = {
'%activity%': '<strong>' ~ activity.name ~ '</strong>',
'%project%': '<strong>-</strong>',
'%customer%': '<strong>-</strong>',
'%records%': '<strong>' ~ stats.recordAmount ~ '</strong>',
'%duration%': '<strong>' ~ stats.recordDuration|duration ~ '</strong>'
'%activity%': activity.name,
'%project%': '-',
'%customer%': '-',
'%records%': stats.recordAmount,
'%duration%': stats.recordDuration|duration
} %}
{% if activity.project is not null %}
{% set params = params|merge({
'%project%': '<strong>' ~ activity.project.name ~ '</strong>',
'%customer%': '<strong>' ~ activity.project.customer.name ~ '</strong>',
'%project%': activity.project.name,
'%customer%': activity.project.customer.name,
}) %}
{% endif %}
{% set message = '<p>' ~ ("admin_activity.short_stats"|trans(params)|raw) ~ '</p><p>' ~ ("admin_entity.delete_confirm"|trans|raw) ~ '</p>' %}
{{ include(app.request.xmlHttpRequest ? 'default/_form_delete_modal.html.twig' : 'default/_form_delete.html.twig', {
'message': message|raw,
'message': ("admin_activity.short_stats"|trans(params) ~ "admin_entity.delete_confirm"|trans),
'form': form,
'used': inUse,
'back': path('admin_activity')

17
templates/activity/embed_budget.html.twig
View File

@@ -4,11 +4,11 @@
{% block box_attributes %}id="budget_box"{% endblock %}
{% block box_body %}
{% set params = {
'%activity%': '<strong>' ~ activity.name ~ '</strong>',
'%project%': '<strong>-</strong>',
'%customer%': '<strong>-</strong>',
'%records%': '<strong>' ~ stats.recordAmount ~ '</strong>',
'%duration%': '<strong>' ~ stats.recordDuration|duration ~ '</strong>'
'%activity%': activity.name,
'%project%': '-',
'%customer%': '-',
'%records%': stats.recordAmount,
'%duration%': stats.recordDuration|duration
} %}
{% set currency = null %}
@@ -18,17 +18,16 @@
{% if activity.project is not null %}
{% set params = params|merge({
'%project%': '<strong>' ~ activity.project.name ~ '</strong>',
'%customer%': '<strong>' ~ activity.project.customer.name ~ '</strong>',
'%project%': activity.project.name,
'%customer%': activity.project.customer.name,
}) %}
{% endif %}
<p>
{{ 'admin_activity.short_stats'|trans(params)|raw }}
{{ 'admin_activity.short_stats'|trans(params) }}
{{ 'label.rate_internal'|trans }}: {{ stats.recordInternalRate|money(currency) }}.
</p>
{{ progress.progressbar(activity.budget, stats.recordRate, 'label.budget'|trans, stats.recordRate|money(currency) ~ ' / ' ~ activity.budget|money(currency) ) }}
{{ progress.progressbar(activity.timeBudget, stats.recordDuration, 'label.timeBudget'|trans, stats.recordDuration|duration ~ ' / ' ~ activity.timeBudget|duration ) }}
{% endblock %}