[Customer Automation Rules ]Escape Rule fields

pimcore · Jan 27, 2022 · 1e7a823 · 1e7a823
1 parent 8b7a45b
commit 1e7a823
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 6 deletions.
diff --git a/src/Controller/Admin/RulesController.php b/src/Controller/Admin/RulesController.php
@@ -48,11 +48,11 @@ public function listAction(Request $request)
             $json[] = [
                 'iconCls' => $icon,
                 'id' => $rule->getId(),
-                'text' => $rule->getName(),
+                'text' => htmlspecialchars($rule->getName()),
                 'leaf' => true,
                 'qtipCfg' => [
-                    'title' => $title,
-                    'text' => $rule->getDescription(),
+                    'title' => htmlspecialchars($title),
+                    'text' => htmlspecialchars($rule->getDescription()),
                 ],
             ];
         }

diff --git a/src/Resources/public/js/config/rule.js b/src/Resources/public/js/config/rule.js
@@ -38,7 +38,7 @@ pimcore.plugin.cmf.config.rule = Class.create({
 
         this.tabPanel = new Ext.TabPanel({
             activeTab: 0,
-            title: rule.name,
+            title: Ext.util.Format.htmlEncode(rule.name),
             closable: true,
             deferredRender: false,
             forceLayout: true,
@@ -119,14 +119,16 @@ pimcore.plugin.cmf.config.rule = Class.create({
                 name: "name",
                 fieldLabel: t("name"),
                 width: 350,
-                value: this.rule.name
+                value: this.rule.name,
+                renderer: Ext.util.Format.htmlEncode
             }, {
                 xtype: "textarea",
                 name: "description",
                 fieldLabel: t("description"),
                 width: 500,
                 height: 100,
-                value: this.rule.description
+                value: this.rule.description,
+                renderer: Ext.util.Format.htmlEncode
             }, {
                 xtype: "checkbox",
                 name: "active",