[Admin UI] Escape query on Search Window

pimcore · Dec 9, 2021 · 34ed0e0 · 34ed0e0
1 parent 9587bb6
commit 34ed0e0
Show file tree

Hide file tree

Showing 3 changed files with 15 additions and 13 deletions.
diff --git a/bundles/AdminBundle/Resources/public/js/pimcore/element/selector/asset.js b/bundles/AdminBundle/Resources/public/js/pimcore/element/selector/asset.js
@@ -269,18 +269,19 @@ pimcore.element.selector.asset = Class.create(pimcore.element.selector.abstract,
     },
 
     search: function () {
-        var formValues = this.formPanel.getForm().getFieldValues();
+        let formValues = this.formPanel.getForm().getFieldValues();
 
-        var proxy = this.store.getProxy();
+        let proxy = this.store.getProxy();
+        let query = Ext.util.Format.htmlEncode(formValues.query);
         proxy.setExtraParam("type", "asset");
-        proxy.setExtraParam("query", formValues.query);
+        proxy.setExtraParam("query", query);
         proxy.setExtraParam("subtype", formValues.subtype);
 
         if (this.parent.config && this.parent.config.context) {
             proxy.setExtraParam("context", Ext.encode(this.parent.config.context));
         }
 
         this.pagingtoolbar.moveFirst();
-        this.updateTabTitle(formValues.query);
+        this.updateTabTitle(query);
     }
 });
diff --git a/bundles/AdminBundle/Resources/public/js/pimcore/element/selector/document.js b/bundles/AdminBundle/Resources/public/js/pimcore/element/selector/document.js
@@ -243,18 +243,19 @@ pimcore.element.selector.document = Class.create(pimcore.element.selector.abstra
     },
 
     search: function () {
-        var formValues = this.formPanel.getForm().getFieldValues();
+        let formValues = this.formPanel.getForm().getFieldValues();
 
-        var proxy = this.store.getProxy();
+        let proxy = this.store.getProxy();
+        let query = Ext.util.Format.htmlEncode(formValues.query);
         proxy.setExtraParam("type", "document");
-        proxy.setExtraParam("query", formValues.query);
+        proxy.setExtraParam("query", query);
         proxy.setExtraParam("subtype", formValues.subtype);
 
         if (this.parent.config && this.parent.config.context) {
             proxy.setExtraParam("context", Ext.encode(this.parent.config.context));
         }
 
         this.pagingtoolbar.moveFirst();
-        this.updateTabTitle(formValues.query);
+        this.updateTabTitle(query);
     }
 });
diff --git a/bundles/AdminBundle/Resources/public/js/pimcore/element/selector/object.js b/bundles/AdminBundle/Resources/public/js/pimcore/element/selector/object.js
@@ -574,12 +574,12 @@ pimcore.element.selector.object = Class.create(pimcore.element.selector.abstract
     },
 
     applyExtraParamsToStore: function () {
-        var formValues = this.formPanel.getForm().getFieldValues();
-
-        var proxy = this.store.getProxy();
+        let formValues = this.formPanel.getForm().getFieldValues();
 
+        let proxy = this.store.getProxy();
+        let query = Ext.util.Format.htmlEncode(formValues.query);
         proxy.setExtraParam("type", "object");
-        proxy.setExtraParam("query", formValues.query);
+        proxy.setExtraParam("query", query);
         proxy.setExtraParam("subtype", formValues.subtype);
         proxy.setExtraParam("class", formValues.class);
 
@@ -591,7 +591,7 @@ pimcore.element.selector.object = Class.create(pimcore.element.selector.abstract
             proxy.setExtraParam("context", Ext.encode(this.parent.config.context));
         }
 
-        this.updateTabTitle(formValues.query);
+        this.updateTabTitle(query);
     },
 
     search: function () {