Mirrors/sftpgo
1
0
Fork 0
mirror of https://github.com/drakkan/sftpgo.git synced 2025-12-06 14:20:55 +03:00
Code Issues Packages Projects Releases Wiki Activity

WebAdmin: ensure to sanitize data before rendering

Browse Source 
Thanks to Polina Zvorykina, VK for reporting this issue

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
This commit is contained in:
Nicola Murino
2023-03-28 12:28:38 +02:00
parent b60d3f680e
commit 084d4109b8
4 changed files with 20 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
templates/webadmin/events.html
View File

@@ -403,7 +403,7 @@ along with this program. If not, see <https://www.gnu.org/licenses/>.
"data": "object_type",
"render": function (data, type, row) {
if (type === 'display') {
let ellipsisFn = $.fn.dataTable.render.ellipsis(70, true);
let ellipsisFn = $.fn.dataTable.render.ellipsis(70, true, true);
return ellipsisFn(`${data}: ${row["object_name"]}`,type);
}
return data;
@@ -411,7 +411,13 @@ along with this program. If not, see <https://www.gnu.org/licenses/>.
},
{
"data": "username",
"defaultContent": ""
"defaultContent": "",
"render": function (data, type, row) {
if (type === 'display') {
return escapeHTML(data);
}
return data;
}
},
{
"data": "ip",
@@ -486,7 +492,7 @@ along with this program. If not, see <https://www.gnu.org/licenses/>.
"data": "virtual_path",
"render": function (data, type, row) {
if (type === 'display') {
let ellipsisFn = $.fn.dataTable.render.ellipsis(70, true);
let ellipsisFn = $.fn.dataTable.render.ellipsis(70, true, true);
if (row["virtual_target_path"]){
return ellipsisFn(`${data} => ${row["virtual_target_path"]}`,type);
}
@@ -497,7 +503,13 @@ along with this program. If not, see <https://www.gnu.org/licenses/>.
},
{
"data": "username",
"defaultContent": ""
"defaultContent": "",
"render": function (data, type, row) {
if (type === 'display') {
return escapeHTML(data);
}
return data;
}
},
{
"data": "protocol",

2
templates/webadmin/iplists.html
View File

@@ -455,7 +455,7 @@ $(document).ready(function () {
"data": "description",
"render": function (data, type, row) {
if (type === 'display') {
let ellipsisFn = $.fn.dataTable.render.ellipsis(70, true);
let ellipsisFn = $.fn.dataTable.render.ellipsis(70, true, true);
return ellipsisFn(data,type);
}
return data;