jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

fix xss (#2060)

Browse Source
This commit is contained in:
Kevin Papst
2020-10-26 11:35:31 +01:00
committed by GitHub
parent 7ae55c1980
commit 6db21d7b34
28 changed files with 157 additions and 91 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
templates/invoice/renderer/default-pdf.pdf.twig
View File

@@ -33,10 +33,10 @@
<tr>
<td>
<strong>{{ 'label.contact'|trans }}</strong>:
{{ model.template.contact|replace({"\n": ' &ndash; ', "\r\n": ' &ndash; ', "\r": ' &ndash; '})|raw }}
{{ model.template.contact|nl2str(' &ndash; ') }}
<br>
<strong>{{ 'label.invoice_bank_account'|trans }}</strong>:
{{ model.template.paymentDetails|replace({"\n": ' &ndash; ', "\r\n": ' &ndash; ', "\r": ' &ndash; '})|raw }}
{{ model.template.paymentDetails|nl2str(' &ndash; ') }}
</td>
<td align="right">
{{ 'export.page_of'|trans({'%page%': '{PAGENO}', '%pages%': '{nb}'}) }}
@@ -151,9 +151,9 @@ mpdf-->
</table>
{% if model.template.paymentTerms is not empty %}
<p>
<div class="paymentTerms">
{{ model.template.paymentTerms|md2html }}
</p>
</div>
{% endif %}
</div>
</body>

8
templates/invoice/renderer/default.html.twig
View File

@@ -127,7 +127,7 @@
<div class="col-xs-12">
{% if model.template.paymentTerms is not empty %}
<div contenteditable="true" class="paymentTerms">
{{ model.template.paymentTerms|nl2br|md2html }}
{{ model.template.paymentTerms|md2html }}
</div>
{% endif %}
</div>
@@ -135,11 +135,11 @@
<footer class="footer">
<p>
<strong>{{ 'label.address'|trans }}</strong>: {{ model.template.company }} &ndash; {{ model.template.address|replace({"\n": ' &ndash; ', "\r\n": ' &ndash; ', "\r": ' &ndash; '})|raw }}
<strong>{{ 'label.address'|trans }}</strong>: {{ model.template.company }} &ndash; {{ model.template.address|nl2str(' &ndash; ') }}
<br>
<strong>{{ 'label.invoice_bank_account'|trans }}</strong>: {{ model.template.paymentDetails|replace({"\n": ' &ndash; ', "\r\n": ' &ndash; ', "\r": ' &ndash; '})|raw }}
<strong>{{ 'label.invoice_bank_account'|trans }}</strong>: {{ model.template.paymentDetails|nl2str(' &ndash; ') }}
<br>
<strong>{{ 'label.contact'|trans }}</strong>: {{ model.template.contact|replace({"\n": ' &ndash; ', "\r\n": ' &ndash; ', "\r": ' &ndash; '})|raw }}
<strong>{{ 'label.contact'|trans }}</strong>: {{ model.template.contact|nl2str(' &ndash; ') }}
</p>
</footer>
{% endblock %}

4
templates/invoice/renderer/freelancer.html.twig
View File

@@ -8,7 +8,7 @@
<div class="col-xs-12">
<header>
<address>
<p contenteditable="true">{{ model.template.company }} &ndash; {{ model.template.address|replace({"\n": ' &ndash; ', "\r\n": ' &ndash; ', "\r": ' &ndash; '})|raw }}</p>
<p contenteditable="true">{{ model.template.company }} &ndash; {{ model.template.address|nl2str(' &ndash; ') }}</p>
</address>
</header>
<article class="address">
@@ -108,7 +108,7 @@
{% if model.template.paymentTerms is not empty %}
<article class="paymentTerms">
<div contenteditable="true">
{{ model.template.paymentTerms|nl2br|md2html }}
{{ model.template.paymentTerms|md2html }}
</div>
</article>
{% endif %}