[Asset] Custom Metadata: properly escape values in grid

pimcore · Aug 25, 2021 · 79a5757 · 79a5757
1 parent af229c0
commit 79a5757
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 3 deletions.
diff --git a/bundles/AdminBundle/Resources/public/js/pimcore/asset/metadata/tags/date.js b/bundles/AdminBundle/Resources/public/js/pimcore/asset/metadata/tags/date.js
@@ -113,7 +113,8 @@ pimcore.asset.metadata.tags.date = Class.create(pimcore.asset.metadata.tags.abst
             }
             return Ext.Date.format(value, "Y-m-d");
         }
-        return value;
+
+        return Ext.util.Format.htmlEncode(value);
     },
 
     marshal: function(value) {

diff --git a/bundles/AdminBundle/Resources/public/js/pimcore/asset/metadata/tags/manyToOneRelation.js b/bundles/AdminBundle/Resources/public/js/pimcore/asset/metadata/tags/manyToOneRelation.js
@@ -251,7 +251,7 @@ pimcore.asset.metadata.tags.manyToOneRelation = Class.create(pimcore.asset.metad
 
     getGridCellRenderer: function(value, metaData, record, rowIndex, colIndex, store) {
         if (value) {
-            value =  nl2br(value);
+            value =  nl2br(Ext.util.Format.htmlEncode(value));
         } else {
             value =  "";
         }

diff --git a/bundles/AdminBundle/Resources/public/js/pimcore/asset/metadata/tags/textarea.js b/bundles/AdminBundle/Resources/public/js/pimcore/asset/metadata/tags/textarea.js
@@ -107,7 +107,7 @@ pimcore.asset.metadata.tags.textarea = Class.create(pimcore.asset.metadata.tags.
 
     getGridCellRenderer: function(value, metaData, record, rowIndex, colIndex, store) {
         if (value) {
-            return nl2br(value);
+            return nl2br(Ext.util.Format.htmlEncode(value));
         } else {
             return "";
         }