From f899a2340f9c4074cdad56e05a9a49b5d413ac2b Mon Sep 17 00:00:00 2001 From: Ahmad Gneady Date: Sat, 10 Jul 2021 21:21:05 +0200 Subject: [PATCH] Fix stored xss issue in nicedit (sandboxing iframes). Prevent directory browsing of various resource folders. Improved UI in homepage. --- app/admin/incFunctions.php | 7 ++++++- app/admin/pageServerStatus.php | 2 +- app/home.php | 4 ++-- app/resources/bootstrap-datetimepicker/index.html | 0 app/resources/hotkeys/index.html | 0 app/resources/moment/index.html | 0 online-invoicing-system.axp | 2 +- 7 files changed, 10 insertions(+), 5 deletions(-) create mode 100644 app/resources/bootstrap-datetimepicker/index.html create mode 100644 app/resources/hotkeys/index.html create mode 100644 app/resources/moment/index.html diff --git a/app/admin/incFunctions.php b/app/admin/incFunctions.php index 282d140..7d5089d 100644 --- a/app/admin/incFunctions.php +++ b/app/admin/incFunctions.php @@ -1691,7 +1691,12 @@ function safe_html($str, $noBr = false) { if($str == strip_tags($str)) return $noBr ? $str : nl2br($str); $hc = new CI_Input(datalist_db_encoding); - return $hc->xss_clean(bgStyleToClass($str)); + $str = $hc->xss_clean(bgStyleToClass($str)); + + // sandbox iframes + $str = preg_replace('/(<|<)iframe(.*?)(>|>)/i', '$1iframe sandbox $2$3', $str); + + return $str; } ######################################################### function getLoggedGroupID() { diff --git a/app/admin/pageServerStatus.php b/app/admin/pageServerStatus.php index 5d35bf4..3ea05f1 100644 --- a/app/admin/pageServerStatus.php +++ b/app/admin/pageServerStatus.php @@ -1,6 +1,6 @@
- " href="_view.php">' : '');?> - + " href="_view.php">' : '');?> +
diff --git a/app/resources/bootstrap-datetimepicker/index.html b/app/resources/bootstrap-datetimepicker/index.html new file mode 100644 index 0000000..e69de29 diff --git a/app/resources/hotkeys/index.html b/app/resources/hotkeys/index.html new file mode 100644 index 0000000..e69de29 diff --git a/app/resources/moment/index.html b/app/resources/moment/index.html new file mode 100644 index 0000000..e69de29 diff --git a/online-invoicing-system.axp b/online-invoicing-system.axp index 588a92d..dd597c9 100644 --- a/online-invoicing-system.axp +++ b/online-invoicing-system.axp @@ -1,4 +1,4 @@ -online_inovicing_systemlocalhostUTF-8False12FalseEurope/LondonFalseFalseTrueFalsebootstrap.cssFalseTrue0246.02021-07-03 19:31:31C:\xampp\htdocs\open-source-apps\online-invoicing-system\app0False1004FalseTrue{"events":{"unpaid-invoice":{"type":"unpaid-invoice","color":"danger","textColor":"danger","table":"invoices","customWhere":"`invoices`.`status` = 'Unpaid'","title":"{5}<br>Invoice# {2}<br>{3}","allDay":true,"startDateField":"date_due","startTimeField":"","endDateField":"","endTimeField":""}},"calendars":{"unpaid-invoices":{"id":"unpaid-invoices","title":"Unpaid invoices","initial-view":"dayGridMonth","initial-date":"[last-month]","events":["unpaid-invoice"],"locale":"","groups":["Admins"],"links-home":"1","links-navmenu":"1"}}}3:4:2:12:14:9001:[{"report_hash":"pprh7b8b2dazav20cln9","title":"Client sales over time","table":"invoices","table_index":0,"label":"client","caption1":"Client","caption2":"Sum of Invoices","group_function":"sum","group_function_field":"total","group_array":[],"look_up_table":"clients","look_up_value":"name","label_field_index":"5","date_field":"date_due","date_field_index":"4","report_header_url":"","report_footer_url":"","data_table_section":1,"barchart_section":0,"piechart_section":0,"override_permissions":0,"custom_where":"","date_separator":"\/"}][{"label":"Mark as paid","icon":"ok","field":"status","value":"fixedValue","fixedValue":"Paid","confirmation":1,"groups":[],"hash":"1nvkk0q0ckqc7b8migay"},{"label":"Mark as cancelled","icon":"remove","field":"status","value":"fixedValue","fixedValue":"Cancelled","confirmation":1,"groups":[],"hash":"xe0xlisfn56ps9sp3p76"}]invoicesFalseFalseTrueFalseFalseTrueFalseTrueTrueTrueTrueTrueTrueFalseTrueTrue15010invoice_items;TrueFalseFalse2descattributes_display.png0True0TruehorizontalFalseFalse25%id400TrueFalseFalseTrueFalseTrueFalseFalse150False0FalseFalseFalseFalse00FalseFalseFalse00FalseFalse0FalseFalseFalseFalseFalse01TrueFalseFalseFalse0False00FalseFalseright0000Falsecode15200FalseFalseFalseFalseTrueFalseFalseFalse60False0FalseFalseFalseFalse00FalseFalseFalse00FalseFalse0FalseFalseFalseFalseFalse01FalseFalseFalseFalse10False00FalseFalseleft0000Falsestatus15200FalseFalseTrueFalseFalseFalseFalseFalse70False0FalseFalseFalseFalse00FalseFalseFalse00FalseFalse0FalseFalseFalseFalseFalse21FalseFalseFalseFalse12False00FalseFalseleft0000Falsedate_due900FalseFalseFalseFalseFalseFalseFalseFalse100False0FalseFalseFalseFalse00FalseFalseFalse00FalseFalse0FalseFalseFalseFalseFalse01FalseFalseFalseFalse1False00FalseFalseleft0000Falseclient400FalseFalseFalseFalseFalseTrueFalseFalse250False0FalseFalseFalseFalse00FalseFalseFalse00FalseFalse0FalseFalsenameidclientsTrueTrueFalse01FalseFalseFalseFalse2False00FalseFalseleft0000Falseclient_contact400FalseFalseFalseFalseFalseTrueFalseFalse200False0FalseFalseFalseFalse00FalseFalseFalse00FalseFalse0FalseFalsecontactidclientsTrueFalseTrue01FalseFalseFalseFalse3False00FalseFalseleft0000Falseclient_address400FalseFalseFalseFalseFalseTrueFalseFalse150False0FalseFalseFalseFalse00FalseFalseFalse00FalseFalse0FalseFalseaddressidclientsTrueFalseTrue01TrueFalseFalseFalse4False00FalseFalseleft0000Falseclient_phone400FalseFalseFalseFalseFalseTrueFalseFalse100False0FalseFalseFalseFalse00FalseFalseFalse00FalseFalse0FalseFalsephoneidclientsTrueFalseTrue01FalseFalseFalseFalse5False00FalseFalseleft0000Falseclient_email400FalseFalseFalseFalseFalseTrueFalseFalse50False0FalseFalseFalseFalse00FalseFalseFalse00FalseFalse0FalseFalseemailidclientsTrueFalseTrue01TrueFalseFalseFalse6False00FalseFalseleft0000Falseclient_website400FalseFalseFalseFalseFalseTrueFalseFalse150False0FalseFalseFalseFalse00FalseFalseFalse00FalseFalse0FalseFalsewebsiteidclientsTrueFalseTrue01TrueFalseFalseFalse8False00FalseFalseleft0000Falseclient_comments400FalseFalseFalseFalseFalseTrueFalseFalse150False0FalseFalseFalseFalse00FalseFalseFalse00FalseFalse0FalseFalsecommentsidclientsTrueFalseTrue01TrueFalseFalseFalse7False00FalseFalseleft0000Falsesubtotal892FalseFalseFalseFalseFalseFalseFalseFalse150False0FalseFalseFalseFalse00FalseFalseFalse00FalseFalse0FalseFalseFalseFalseFalse01TrueFalseFalseTrue14False00FalseFalseright0000Trueonline_inovicing_systemlocalhostUTF-8False12FalseEurope/LondonFalseFalseTrueFalsebootstrap.cssFalseTrue0246.02021-07-10 21:20:39C:\xampp\htdocs\open-source-apps\online-invoicing-system\app0False1004FalseTrue{"events":{"unpaid-invoice":{"type":"unpaid-invoice","color":"danger","textColor":"danger","table":"invoices","customWhere":"`invoices`.`status` = 'Unpaid'","title":"{5}<br>Invoice# {2}<br>{3}","allDay":true,"startDateField":"date_due","startTimeField":"","endDateField":"","endTimeField":""}},"calendars":{"unpaid-invoices":{"id":"unpaid-invoices","title":"Unpaid invoices","initial-view":"dayGridMonth","initial-date":"[last-month]","events":["unpaid-invoice"],"locale":"","groups":["Admins"],"links-home":"1","links-navmenu":"1"}}}
3:4:2:12:14:9001:[{"report_hash":"pprh7b8b2dazav20cln9","title":"Client sales over time","table":"invoices","table_index":0,"label":"client","caption1":"Client","caption2":"Sum of Invoices","group_function":"sum","group_function_field":"total","group_array":[],"look_up_table":"clients","look_up_value":"name","label_field_index":"5","date_field":"date_due","date_field_index":"4","report_header_url":"","report_footer_url":"","data_table_section":1,"barchart_section":0,"piechart_section":0,"override_permissions":0,"custom_where":"","date_separator":"\/"}][{"label":"Mark as paid","icon":"ok","field":"status","value":"fixedValue","fixedValue":"Paid","confirmation":1,"groups":[],"hash":"1nvkk0q0ckqc7b8migay"},{"label":"Mark as cancelled","icon":"remove","field":"status","value":"fixedValue","fixedValue":"Cancelled","confirmation":1,"groups":[],"hash":"xe0xlisfn56ps9sp3p76"}]invoicesFalseFalseTrueFalseFalseTrueFalseTrueTrueTrueTrueTrueTrueFalseTrueTrue15010invoice_items;TrueFalseFalse2descattributes_display.png0True0TruehorizontalFalseFalse25%id400TrueFalseFalseTrueFalseTrueFalseFalse150False0FalseFalseFalseFalse00FalseFalseFalse00FalseFalse0FalseFalseFalseFalseFalse01TrueFalseFalseFalse0False00FalseFalseright0000Falsecode15200FalseFalseFalseFalseTrueFalseFalseFalse60False0FalseFalseFalseFalse00FalseFalseFalse00FalseFalse0FalseFalseFalseFalseFalse01FalseFalseFalseFalse10False00FalseFalseleft0000Falsestatus15200FalseFalseTrueFalseFalseFalseFalseFalse70False0FalseFalseFalseFalse00FalseFalseFalse00FalseFalse0FalseFalseFalseFalseFalse21FalseFalseFalseFalse12False00FalseFalseleft0000Falsedate_due900FalseFalseFalseFalseFalseFalseFalseFalse100False0FalseFalseFalseFalse00FalseFalseFalse00FalseFalse0FalseFalseFalseFalseFalse01FalseFalseFalseFalse1False00FalseFalseleft0000Falseclient400FalseFalseFalseFalseFalseTrueFalseFalse250False0FalseFalseFalseFalse00FalseFalseFalse00FalseFalse0FalseFalsenameidclientsTrueTrueFalse01FalseFalseFalseFalse2False00FalseFalseleft0000Falseclient_contact400FalseFalseFalseFalseFalseTrueFalseFalse200False0FalseFalseFalseFalse00FalseFalseFalse00FalseFalse0FalseFalsecontactidclientsTrueFalseTrue01FalseFalseFalseFalse3False00FalseFalseleft0000Falseclient_address400FalseFalseFalseFalseFalseTrueFalseFalse150False0FalseFalseFalseFalse00FalseFalseFalse00FalseFalse0FalseFalseaddressidclientsTrueFalseTrue01TrueFalseFalseFalse4False00FalseFalseleft0000Falseclient_phone400FalseFalseFalseFalseFalseTrueFalseFalse100False0FalseFalseFalseFalse00FalseFalseFalse00FalseFalse0FalseFalsephoneidclientsTrueFalseTrue01FalseFalseFalseFalse5False00FalseFalseleft0000Falseclient_email400FalseFalseFalseFalseFalseTrueFalseFalse50False0FalseFalseFalseFalse00FalseFalseFalse00FalseFalse0FalseFalseemailidclientsTrueFalseTrue01TrueFalseFalseFalse6False00FalseFalseleft0000Falseclient_website400FalseFalseFalseFalseFalseTrueFalseFalse150False0FalseFalseFalseFalse00FalseFalseFalse00FalseFalse0FalseFalsewebsiteidclientsTrueFalseTrue01TrueFalseFalseFalse8False00FalseFalseleft0000Falseclient_comments400FalseFalseFalseFalseFalseTrueFalseFalse150False0FalseFalseFalseFalse00FalseFalseFalse00FalseFalse0FalseFalsecommentsidclientsTrueFalseTrue01TrueFalseFalseFalse7False00FalseFalseleft0000Falsesubtotal892FalseFalseFalseFalseFalseFalseFalseFalse150False0FalseFalseFalseFalse00FalseFalseFalse00FalseFalse0FalseFalseFalseFalseFalse01TrueFalseFalseTrue14False00FalseFalseright0000Truediscount842FalseFalseFalseFalseFalseFalseFalseFalse150False0FalseFalseFalseFalse00FalseFalseFalse00FalseFalse0FalseFalseFalseFalseFalse01TrueFalseFalseFalse13False00FalseFalseright0000Falsetax892FalseFalseFalseFalseFalseFalseFalseFalse150False0FalseFalseFalseFalse00FalseFalseFalse00FalseFalse0FalseFalseFalseFalseFalse01TrueFalseFalseFalse15False00FalseFalseright0000Falsetotal892FalseFalseFalseFalseFalseFalseTrueFalse70False0FalseFalseFalseFalse00FalseFalseFalse00FalseFalse0FalseFalseFalseFalseFalse01FalseFalseFalseTrue9False00FalseFalseright0000True