Skip to content

Commit

Permalink
[Classification Store] Properly escape values on grids & titles
Browse files Browse the repository at this point in the history
  • Loading branch information
@dvesh3
dvesh3 committed Dec 21, 2021
1 parent 4fabd62 commit d5c3e87
Show file tree
Hide file tree
Showing 6 changed files with 31 additions and 20 deletions.
6 changes: 3 additions & 3 deletions bundles/AdminBundle/Controller/Admin/DataObject/ClassificationstoreController.php
View file
Expand Up @@ -1476,19 +1476,19 @@ public function storetreeAction(Request $request)
foreach ($list as $item) {
$resultItem = [
'id' => $item->getId(),
'text' => $item->getName(),
'text' => htmlspecialchars($item->getName(), ENT_QUOTES),
'expandable' => false,
'leaf' => true,
'expanded' => true,
'description' => $item->getDescription(),
'description' => htmlspecialchars($item->getDescription(), ENT_QUOTES),
'iconCls' => 'pimcore_icon_classificationstore',
];

$resultItem['qtitle'] = 'ID: ' . $item->getId();

if ($item->getDescription()) {
}
$resultItem['qtip'] = $item->getDescription() ? $item->getDescription() : ' ';
$resultItem['qtip'] = $item->getDescription() ? htmlspecialchars($item->getDescription(), ENT_QUOTES) : ' ';
$result[] = $resultItem;
}

Expand Down
2 changes: 1 addition & 1 deletion bundles/AdminBundle/Resources/public/js/pimcore/helpers/generic-grid.js
View file
Expand Up @@ -138,5 +138,5 @@ pimcore.helpers.grid.buildDefaultPagingToolbar = function (store, options) {
};

pimcore.helpers.grid.getTranslationColumnRenderer = function (value, metaData, record, rowIndex, colIndex, store) {
return t(value);
return Ext.util.Format.htmlEncode(t(value));
};
14 changes: 9 additions & 5 deletions ...es/AdminBundle/Resources/public/js/pimcore/object/classificationstore/collectionsPanel.js
View file
Expand Up @@ -116,8 +116,10 @@ pimcore.object.classificationstore.collectionsPanel = Class.create({
});

gridColumns.push({text: t("group_id"), flex: 60, sortable: true, dataIndex: 'groupId', filter: 'string'});
gridColumns.push({text: t("name"), flex: 200, sortable: true, dataIndex: 'groupName', filter: 'string'});
gridColumns.push({text: t("description"), flex: 200, sortable: true, dataIndex: 'groupDescription', filter: 'string'});
gridColumns.push({text: t("name"), flex: 200, sortable: true, dataIndex: 'groupName', filter: 'string',
renderer: Ext.util.Format.htmlEncode});
gridColumns.push({text: t("description"), flex: 200, sortable: true, dataIndex: 'groupDescription', filter: 'string',
renderer: Ext.util.Format.htmlEncode});

gridColumns.push({text: t('sorter'), width: 150, sortable: true, dataIndex: 'sorter',
tooltip: t("classificationstore_tooltip_sorter"),
Expand Down Expand Up @@ -264,8 +266,10 @@ pimcore.object.classificationstore.collectionsPanel = Class.create({

//gridColumns.push({text: t("store"), flex: 60, sortable: true, dataIndex: 'storeId', filter: 'string'});
gridColumns.push({text: "ID", flex: 60, sortable: true, dataIndex: 'id', filter: 'string'});
gridColumns.push({text: t("name"), flex: 200, sortable: true, dataIndex: 'name', editor: new Ext.form.TextField({}), filter: 'string'});
gridColumns.push({text: t("description"), flex: 300, sortable: true, dataIndex: 'description', editor: new Ext.form.TextField({}), filter: 'string'});
gridColumns.push({text: t("name"), flex: 200, sortable: true, dataIndex: 'name', editor: new Ext.form.TextField({}), filter: 'string',
renderer: Ext.util.Format.htmlEncode});
gridColumns.push({text: t("description"), flex: 300, sortable: true, dataIndex: 'description', editor: new Ext.form.TextField({}), filter: 'string',
renderer: Ext.util.Format.htmlEncode});

var dateRenderer = function(d) {
if (d !== undefined) {
Expand Down Expand Up @@ -359,7 +363,7 @@ pimcore.object.classificationstore.collectionsPanel = Class.create({
if (selected.length > 0) {
var record = selected[0];
var collectionId = record.data.id;
var collectionName = record.data.name;
var collectionName = Ext.util.Format.htmlEncode(record.data.name);

this.collectionId = collectionId;

Expand Down
14 changes: 9 additions & 5 deletions bundles/AdminBundle/Resources/public/js/pimcore/object/classificationstore/groupsPanel.js
View file
Expand Up @@ -119,8 +119,10 @@ pimcore.object.classificationstore.groupsPanel = Class.create({


gridColumns.push({text: t("key_id"), flex: 60, sortable: true, dataIndex: 'keyId', filter: 'string'});
gridColumns.push({text: t("name"), flex: 200, sortable: true, dataIndex: 'keyName', filter: 'string'});
gridColumns.push({text: t("description"), flex: 200, sortable: true, dataIndex: 'keyDescription', filter: 'string'});
gridColumns.push({text: t("name"), flex: 200, sortable: true, dataIndex: 'keyName', filter: 'string',
renderer: Ext.util.Format.htmlEncode});
gridColumns.push({text: t("description"), flex: 200, sortable: true, dataIndex: 'keyDescription', filter: 'string',
renderer: Ext.util.Format.htmlEncode});

gridColumns.push(mandatoryCheck);
gridColumns.push({text: t('sorter'), width: 150, sortable: true, dataIndex: 'sorter',
Expand Down Expand Up @@ -269,8 +271,10 @@ pimcore.object.classificationstore.groupsPanel = Class.create({
//gridColumns.push({text: t("store"), width: 60, sortable: true, dataIndex: 'storeId', filter: 'string'});
gridColumns.push({text: "ID", width: 60, sortable: true, dataIndex: 'id', filter: 'string'});
gridColumns.push({text: t("parent_id"), width: 160, sortable: true, dataIndex: 'parentId', hidden: true, editor: new Ext.form.TextField({})});
gridColumns.push({text: t("name"), flex: 200, sortable: true, dataIndex: 'name', editor: new Ext.form.TextField({}), filter: 'string'});
gridColumns.push({text: t("description"), flex: 300, sortable: true, dataIndex: 'description', editor: new Ext.form.TextField({}), filter: 'string'});
gridColumns.push({text: t("name"), flex: 200, sortable: true, dataIndex: 'name', editor: new Ext.form.TextField({}), filter: 'string',
renderer: Ext.util.Format.htmlEncode});
gridColumns.push({text: t("description"), flex: 300, sortable: true, dataIndex: 'description', editor: new Ext.form.TextField({}), filter: 'string',
renderer: Ext.util.Format.htmlEncode});

var dateRenderer = function(d) {
if (d !== undefined) {
Expand Down Expand Up @@ -365,7 +369,7 @@ pimcore.object.classificationstore.groupsPanel = Class.create({
if (selected.length > 0) {
var record = selected[0];
var groupId = record.data.id;
var groupName = record.data.name;
var groupName = Ext.util.Format.htmlEncode(record.data.name);

this.groupId = groupId;

Expand Down
11 changes: 7 additions & 4 deletions ...les/AdminBundle/Resources/public/js/pimcore/object/classificationstore/propertiesPanel.js
View file
Expand Up @@ -125,13 +125,16 @@ pimcore.object.classificationstore.propertiespanel = Class.create({
sortable: true,
dataIndex: 'name',
filter: 'string',
editor: new Ext.form.TextField({})
editor: new Ext.form.TextField({}),
renderer: Ext.util.Format.htmlEncode
}

);

gridColumns.push({text: t("title"), width: 200, sortable: false, dataIndex: 'title',editor: new Ext.form.TextField({}), filter: 'string'});
gridColumns.push({text: t("description"), width: 300, sortable: true, dataIndex: 'description',editor: new Ext.form.TextField({}), filter: 'string'});
gridColumns.push({text: t("title"), width: 200, sortable: false, dataIndex: 'title',editor: new Ext.form.TextField({}), filter: 'string',
renderer: Ext.util.Format.htmlEncode});
gridColumns.push({text: t("description"), width: 300, sortable: true, dataIndex: 'description',editor: new Ext.form.TextField({}), filter: 'string',
renderer: Ext.util.Format.htmlEncode});
gridColumns.push({text: t("definition"), width: 300, sortable: true, hidden: true, dataIndex: 'definition',editor: new Ext.form.TextField({})});
gridColumns.push({text: t("type"), width: 150, sortable: true, dataIndex: 'type', filter: 'string',
editor: new Ext.form.ComboBox({
Expand Down Expand Up @@ -285,7 +288,7 @@ pimcore.object.classificationstore.propertiespanel = Class.create({
var definition = data.data.definition;
if (definition) {
definition = Ext.util.JSON.decode(definition);
definition.name = data.data.name;
definition.name = Ext.util.Format.htmlEncode(data.data.name);
} else {
definition = {
name: data.data.name
Expand Down
4 changes: 2 additions & 2 deletions bundles/AdminBundle/Resources/public/js/pimcore/object/classificationstore/storeTree.js
View file
Expand Up @@ -166,8 +166,8 @@ pimcore.object.classificationstore.storeTree = Class.create({
"click": function() {
var data = {
id: record.data.id,
name: record.data.text,
description: record.data.description
name: Ext.util.Format.htmlDecode(record.data.text),
description: Ext.util.Format.htmlDecode(record.data.description)
}
var panel = new pimcore.object.classificationstore.storeConfiguration(data, this.applyConfig.bind(this));
panel.show();
Expand Down

0 comments on commit d5c3e87

Please sign in to comment.