jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

fixed xss in timesheet description (#962)

Browse Source
This commit is contained in:
Kevin Papst
2019-07-14 13:58:10 +02:00
committed by GitHub
parent e68b7da1f8
commit a0e8aa3a43
7 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/Twig/MarkdownExtension.php
View File

@@ -77,6 +77,6 @@ class MarkdownExtension extends AbstractExtension
*/ */
public function markdownToHtml(string $content): string public function markdownToHtml(string $content): string
{ {
return $this->markdown->toHtml($content, true); return $this->markdown->toHtml($content, false);
} }
} }

2
templates/export/renderer/default.html.twig
View File

@@ -276,7 +276,7 @@
</td> </td>
<td class="column-description" {% if not columns.description %}style="display: none"{% endif %}> <td class="column-description" {% if not columns.description %}style="display: none"{% endif %}>
{% if entry.description is not empty %} {% if entry.description is not empty %}
{{ entry.description|desc2html }} {{ entry.description|escape|desc2html }}
{% endif %} {% endif %}
</td> </td>
<td class="column-exported" {% if not columns.exported %}style="display: none"{% endif %}> <td class="column-exported" {% if not columns.exported %}style="display: none"{% endif %}>

2
templates/export/renderer/pdf.html.twig
View File

@@ -151,7 +151,7 @@ mpdf-->
{{ entry.project.customer.name }} - {{ entry.project.name }} - {{ entry.activity.name }} {{ entry.project.customer.name }} - {{ entry.project.name }} - {{ entry.activity.name }}
{% if entry.description is not empty %} {% if entry.description is not empty %}
<br> <br>
<i>{{ entry.description|desc2html }}</i> <i>{{ entry.description|escape|desc2html }}</i>
{% endif %} {% endif %}
</td> </td>
<td class="duration">{{ entry.duration|duration }}</td> <td class="duration">{{ entry.duration|duration }}</td>

2
templates/invoice/index.html.twig
View File

@@ -56,7 +56,7 @@
<td class="{{ tables.data_table_column_class(tableName, columns, 'user') }}">{{ widgets.label_user(entry.user) }}</td> <td class="{{ tables.data_table_column_class(tableName, columns, 'user') }}">{{ widgets.label_user(entry.user) }}</td>
<td class="{{ tables.data_table_column_class(tableName, columns, 'description') }} timesheet-description"> <td class="{{ tables.data_table_column_class(tableName, columns, 'description') }} timesheet-description">
{% if entry.description is not empty %} {% if entry.description is not empty %}
{{ entry.description|desc2html }} {{ entry.description|escape|desc2html }}
{% else %} {% else %}
{{ entry.activity.name }} / {{ entry.project.name }} {{ entry.activity.name }} / {{ entry.project.name }}
{% endif %} {% endif %}

2
templates/timesheet-team/export.html.twig
View File

@@ -49,7 +49,7 @@
<td> <td>
{% if entry.description is not empty %} {% if entry.description is not empty %}
<div> <div>
{{ entry.description|desc2html }} {{ entry.description|escape|desc2html }}
</div> </div>
{% endif %} {% endif %}
<span class="small"> <span class="small">

2
templates/timesheet/export.html.twig
View File

@@ -41,7 +41,7 @@
<td> <td>
{% if entry.description is not empty %} {% if entry.description is not empty %}
<div> <div>
{{ entry.description|desc2html }} {{ entry.description|escape|desc2html }}
</div> </div>
{% endif %} {% endif %}
<span class="small"> <span class="small">

2
templates/timesheet/index.html.twig
View File

@@ -95,7 +95,7 @@
<td class="{{ tables.data_table_column_class(tableName, columns, 'customer') }}">{{ widgets.label_customer(entry.project.customer) }}</td> <td class="{{ tables.data_table_column_class(tableName, columns, 'customer') }}">{{ widgets.label_customer(entry.project.customer) }}</td>
<td class="{{ tables.data_table_column_class(tableName, columns, 'project') }}">{{ widgets.label_project(entry.project) }}</td> <td class="{{ tables.data_table_column_class(tableName, columns, 'project') }}">{{ widgets.label_project(entry.project) }}</td>
<td class="{{ tables.data_table_column_class(tableName, columns, 'activity') }}">{{ widgets.label_activity(entry.activity) }}</td> <td class="{{ tables.data_table_column_class(tableName, columns, 'activity') }}">{{ widgets.label_activity(entry.activity) }}</td>
<td class="{{ tables.data_table_column_class(tableName, columns, 'description') }} timesheet-description">{{ entry.description|desc2html }}</td> <td class="{{ tables.data_table_column_class(tableName, columns, 'description') }} timesheet-description">{{ entry.description|escape|desc2html }}</td>
<td class="{{ tables.data_table_column_class(tableName, columns, 'tags') }}">{{ widgets.tag_list(entry.tags) }}</td> <td class="{{ tables.data_table_column_class(tableName, columns, 'tags') }}">{{ widgets.tag_list(entry.tags) }}</td>
<td class="actions"> <td class="actions">
{{- actions.timesheet(entry, 'index') -}} {{- actions.timesheet(entry, 'index') -}}