From ebbf6e56befda2070b00d68c7c3e531a6ce6b59e Mon Sep 17 00:00:00 2001 From: Molkobain Date: Wed, 7 Jul 2021 09:27:34 +0200 Subject: [PATCH] =?UTF-8?q?N=C2=B04127=20-=20Security:=20Fix=20XSS=20vulne?= =?UTF-8?q?rability=20in=20object=20attribute's=20tooltip?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- application/cmdbabstract.class.inc.php | 11 +++--- css/backoffice/vendors/_all.scss | 1 + css/backoffice/vendors/_tippy.scss | 9 +++++ .../precompiled-themes/fullmoon/main.css | 9 ++++- .../precompiled-themes/test-red/main.css | 9 ++++- js/utils.js | 38 +++++++++++-------- 6 files changed, 54 insertions(+), 23 deletions(-) create mode 100644 css/backoffice/vendors/_tippy.scss diff --git a/application/cmdbabstract.class.inc.php b/application/cmdbabstract.class.inc.php index b9f3b49a4e..ae7cdac756 100644 --- a/application/cmdbabstract.class.inc.php +++ b/application/cmdbabstract.class.inc.php @@ -2533,14 +2533,13 @@ public static function GetFormElementForField($oPage, $sClass, $sAttCode, $oAttD $sDisplayValueForHtml = utils::EscapeHtml($sDisplayValue); // Adding tooltip so we can read the whole value when its very long (eg. URL) - $sTip = ''; + $sTip = ''; if (!empty($sDisplayValue)) { $sTip = 'data-tooltip-content="'.$sDisplayValueForHtml.'"'; - $oPage->add_ready_script( - <<add_ready_script(<<').html(oElem.attr('data-tooltip-content')); - let sContent = ''; - if (bEnableHTML) { - sContent = oTmpContentElem.html(); - if (bSanitizeContent) { - sContent = sContent.replace(/