Fix xss admin

s-cart · Jan 29, 2022 · 48e720c · 48e720c
1 parent 32e18d0
commit 48e720c
Show file tree

Hide file tree

Showing 4 changed files with 12 additions and 6 deletions.
diff --git a/app/Plugins/Cms/Content/Admin/CmsCategoryController.php b/app/Plugins/Cms/Content/Admin/CmsCategoryController.php
@@ -182,6 +182,7 @@ public function postCreate()
             'sort'     => (int) $data['sort'],
             'store_id' => session('adminStoreId'),
         ];
+        $dataInsert = sc_clean($dataInsert, [], true);
 
         $category = AdminCmsCategory::createCategoryAdmin($dataInsert);
         $id = $category->id;
@@ -196,6 +197,7 @@ public function postCreate()
                 'description' => $data['descriptions'][$code]['description'],
             ];
         }
+        $dataDes = sc_clean($dataDes, [], true);
         AdminCmsCategory::insertDescriptionAdmin($dataDes);
 
         sc_clear_cache('cache_cms_category');
@@ -273,7 +275,7 @@ public function postEdit($id)
             'status'   => empty($data['status']) ? 0 : 1,
             'store_id' => session('adminStoreId'),
         ];
-
+        $dataUpdate = sc_clean($dataUpdate, [], true);
         $category->update($dataUpdate);
         $category->descriptions()->delete();
         $dataDes = [];
@@ -286,7 +288,7 @@ public function postEdit($id)
                 'description' => $row['description'],
             ];
         }
-
+        $dataDes = sc_clean($dataDes, [], true);
         AdminCmsCategory::insertDescriptionAdmin($dataDes);
 
         sc_clear_cache('cache_cms_category');

diff --git a/app/Plugins/Cms/Content/Admin/CmsContentController.php b/app/Plugins/Cms/Content/Admin/CmsContentController.php
@@ -185,6 +185,7 @@ public function postCreate()
             'sort'        => (int) $data['sort'],
             'store_id'    => session('adminStoreId'),
         ];
+        $dataInsert = sc_clean($dataInsert, [], true);
         $content = AdminCmsContent::createContentAdmin($dataInsert);
         $id = $content->id;
         $dataDes = [];
@@ -199,6 +200,7 @@ public function postCreate()
                 'content' => $data['descriptions'][$code]['content'],
             ];
         }
+        $dataDes = sc_clean($dataDes, ['content'], true);
         AdminCmsContent::insertDescriptionAdmin($dataDes);
         sc_clear_cache('cache_cms_content');
         return redirect()->route('admin_cms_content.index')
@@ -267,8 +269,7 @@ public function postEdit($id)
                 ->withErrors($validator)
                 ->withInput($data);
         }
-//Edit
-        $store = $data['store'] ?? [];
+        //Edit
         $dataUpdate = [
             'image'       => $data['image'],
             'alias'       => $data['alias'],
@@ -277,7 +278,7 @@ public function postEdit($id)
             'status'      => empty($data['status']) ? 0 : 1,
             'store_id'    => session('adminStoreId'),
         ];
-
+        $dataUpdate = sc_clean($dataUpdate, [], true);
         $content->update($dataUpdate);
         $content->descriptions()->delete();
         $dataDes = [];
@@ -291,6 +292,7 @@ public function postEdit($id)
                 'content'     => $row['content'],
             ];
         }
+        $dataDes = sc_clean($dataDes, ['content'], true);
         AdminCmsContent::insertDescriptionAdmin($dataDes);
         sc_clear_cache('cache_cms_content');
         return redirect()->route('admin_cms_content.index')->with('success', sc_language_render($this->plugin->pathPlugin.'::Content.admin.edit_success'));

diff --git a/app/Plugins/Total/Discount/Admin/AdminController.php b/app/Plugins/Total/Discount/Admin/AdminController.php
@@ -212,6 +212,7 @@ public function postCreate()
         if(!empty($data['expires_at'])) {
             $dataInsert['expires_at'] = $data['expires_at'];
         }
+        $dataInsert = sc_clean($dataInsert, [], true);
         $discount = AdminDiscount::createDiscountAdmin($dataInsert);
 
         $shopStore        = $data['shop_store'] ?? [session('adminStoreId')];
@@ -284,6 +285,7 @@ public function postEdit($id)
         if(!empty($data['expires_at'])) {
             $dataUpdate['expires_at'] = $data['expires_at'];
         }
+        $dataUpdate = sc_clean($dataUpdate, [], true);
         $discount->update($dataUpdate);
 
         $shopStore        = $data['shop_store'] ?? [session('adminStoreId')];

diff --git a/config/s-cart.php b/config/s-cart.php
@@ -1,7 +1,7 @@
 <?php
 return [
     'version'     => '6.8',
-    'sub-version' => '6.8.3',
+    'sub-version' => '6.8.4',
     'type'        => 'basic',
     'homepage'    => 'https://s-cart.org',
     'title'       => 'Free Open Source eCommerce for Business',