escape customer, project and activity name in javascript (#2959)

kimai · Nov 19, 2021 · 89bfa82 · 89bfa82
1 parent 8591313
commit 89bfa82
Show file tree

Hide file tree

Showing 7 changed files with 23 additions and 7 deletions.
diff --git a/assets/js/KimaiPlugin.js b/assets/js/KimaiPlugin.js
@@ -66,4 +66,19 @@ export default class KimaiPlugin {
         return this.getContainer().getPlugin(name);
     }
 
+    /**
+     * @param {string} title
+     * @returns {string}
+     */
+    escape(title) {
+        const tagsToReplace = {
+            '&': '&amp;',
+            '<': '&lt;',
+            '>': '&gt;',
+        };
+
+        return title.replace(/[&<>]/g, function(tag) {
+            return tagsToReplace[tag] || tag;
+        });
+    };
 }
diff --git a/assets/js/plugins/KimaiRecentActivities.js b/assets/js/plugins/KimaiRecentActivities.js
@@ -65,9 +65,10 @@ export default class KimaiRecentActivities extends KimaiPlugin {
 
         for (let timesheet of entries) {
             let label = this.attributes['template']
-                .replace('%customer%', timesheet.project.customer.name)
-                .replace('%project%', timesheet.project.name)
-                .replace('%activity%', timesheet.activity.name);
+                .replace('%customer%', this.escape(timesheet.project.customer.name))
+                .replace('%project%', this.escape(timesheet.project.name))
+                .replace('%activity%', this.escape(timesheet.activity.name))
+            ;
 
             htmlToInsert +=
                 `<li>` +

diff --git a/public/build/app.3947eaef.js b/public/build/app.3947eaef.js
diff --git a/public/build/app.9e8f68cf.js b/public/build/app.9e8f68cf.js
diff --git a/public/build/app.3947eaef.js.LICENSE.txt → public/build/app.9e8f68cf.js.LICENSE.txt b/public/build/app.3947eaef.js.LICENSE.txt → public/build/app.9e8f68cf.js.LICENSE.txt
diff --git a/public/build/entrypoints.json b/public/build/entrypoints.json
@@ -3,7 +3,7 @@
     "app": {
       "js": [
         "build/runtime.b8e7bb04.js",
-        "build/app.3947eaef.js"
+        "build/app.9e8f68cf.js"
       ],
       "css": [
         "build/app.3bc2b4d9.css"

diff --git a/public/build/manifest.json b/public/build/manifest.json
@@ -1,6 +1,6 @@
 {
   "build/app.css": "build/app.3bc2b4d9.css",
-  "build/app.js": "build/app.3947eaef.js",
+  "build/app.js": "build/app.9e8f68cf.js",
   "build/invoice.css": "build/invoice.ff32661a.css",
   "build/invoice.js": "build/invoice.19f36eca.js",
   "build/invoice-pdf.css": "build/invoice-pdf.9a7468ef.css",