Skip to content

Commit

Permalink
Add escape flag for XSS mitigation (#3379)
Browse files Browse the repository at this point in the history
  • Loading branch information
@jekkos
jekkos committed Apr 14, 2022
1 parent 3e60b74 commit 9331d82
Showing 1 changed file with 5 additions and 4 deletions.
9 changes: 5 additions & 4 deletions application/helpers/tabular_helper.php
View file
Expand Up @@ -42,6 +42,7 @@ function transform_headers($array, $readonly = FALSE, $editable = TRUE)
$result[] = array('field' => key($element),
'title' => current($element),
'switchable' => isset($element['switchable']) ? $element['switchable'] : !preg_match('(^$|&nbsp)', current($element)),
'escape' => key($element) != "edit" && !(isset($element['escape']) && !$element['escape']),
'sortable' => isset($element['sortable']) ? $element['sortable'] : current($element) != '',
'checkbox' => isset($element['checkbox']) ? $element['checkbox'] : FALSE,
'class' => isset($element['checkbox']) || preg_match('(^$|&nbsp)', current($element)) ? 'print_hide' : '',
Expand Down Expand Up @@ -72,10 +73,10 @@ function get_sales_manage_table_headers()
if($CI->config->item('invoice_enable') == TRUE)
{
$headers[] = array('invoice_number' => $CI->lang->line('sales_invoice_number'));
$headers[] = array('invoice' => '&nbsp', 'sortable' => FALSE);
$headers[] = array('invoice' => '&nbsp', 'sortable' => FALSE, 'escape' => FALSE);
}

$headers[] = array('receipt' => '&nbsp', 'sortable' => FALSE);
$headers[] = array('receipt' => '&nbsp', 'sortable' => FALSE, 'escape' => FALSE);

return transform_headers($headers);
}
Expand Down Expand Up @@ -350,8 +351,8 @@ function get_items_manage_table_headers()
$headers[] = array($definition_id => $definition_name, 'sortable' => FALSE);
}

$headers[] = array('inventory' => '');
$headers[] = array('stock' => '');
$headers[] = array('inventory' => '', 'escape' => FALSE);
$headers[] = array('stock' => '', 'escape' => FALSE);

return transform_headers($headers);
}
Expand Down

7 comments on commit 9331d82

@odiea
Copy link
Collaborator

@odiea odiea commented on 9331d82 Apr 17, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is now showing in the Sales Takings Table.

2022-04-17 09_57_25-Window

@jekkos
Copy link
Member Author

@jekkos jekkos commented on 9331d82 Apr 18, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok I missed that. The solution here is to apply styling on the last row of the table itself instead of having it in the cell contents. Separation of view and representation logic. I'll add a line to manage.php and remove the bold tags in the controller beginning next week.

@odiea
Copy link
Collaborator

@odiea odiea commented on 9331d82 Apr 19, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No Table appears to be showing in Items for the Dev Demo?

@jekkos
Copy link
Member Author

@jekkos jekkos commented on 9331d82 Apr 20, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok someone might have found a bug here.i will need to check the errors to see what is going on here.

@jekkos
Copy link
Member Author

@jekkos jekkos commented on 9331d82 Apr 25, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@odiea seems fine now on the dev server.

@odiea
Copy link
Collaborator

@odiea odiea commented on 9331d82 May 1, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jekkos Sorry but I just found another issue. If Avatars are being used in Items.

2022-05-01 06_15_51-Window

@jekkos
Copy link
Member Author

@jekkos jekkos commented on 9331d82 May 3, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the report. Seems fine now, fix merged.

Please sign in to comment.