jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

fix xss (#2060)

Browse Source
This commit is contained in:
Kevin Papst
2020-10-26 11:35:31 +01:00
committed by GitHub
parent 7ae55c1980
commit 6db21d7b34
28 changed files with 157 additions and 91 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
templates/export/index.html.twig
View File

@@ -116,7 +116,7 @@
</td>
<td class="{{ tables.data_table_column_class(tableName, columns, 'activity') }}">{{ widgets.label_activity(entry.activity) }}</td>
<td class="{{ tables.data_table_column_class(tableName, columns, 'description') }}">
{{ entry.description|escape|desc2html }}
{{ entry.description|desc2html }}
</td>
<td class="{{ tables.data_table_column_class(tableName, columns, 'unit_price') }}">
{{ rate|money(currency) }}

2
templates/export/pdf-layout.html.twig
View File

@@ -263,7 +263,7 @@ mpdf-->
{{ entry.project.customer.name }} - {{ entry.project.name }}{% if entry.activity is not null %} - {{ entry.activity.name }}{% endif %}
{% if entry.description is not empty %}
<br>
<i>{{ entry.description|escape|desc2html }}</i>
<i>{{ entry.description|desc2html }}</i>
{% endif %}
</td>
<td class="duration">{{ entry.duration|duration(decimal) }}</td>

2
templates/export/renderer/default.html.twig
View File

@@ -440,7 +440,7 @@
</td>
<td class="column-description" {% if not columns.description %}style="display: none"{% endif %}>
{% if entry.description is not empty %}
{{ entry.description|escape|desc2html }}
{{ entry.description|desc2html }}
{% endif %}
</td>
<td class="column-exported" {% if not columns.exported %}style="display: none"{% endif %}>