chamilo
/
chamilo-lms
mirror of https://github.com/chamilo/chamilo-lms/tree/1.11.x
2
0
Fork 0
Code Issues Projects Releases Wiki Activity

Portfolio: Remove xss - refs BT#18201

Browse Source
pull/3766/head^2
Angel Fernando Quiroz Campos 5 years ago
parent 8a3c65edb4
commit a062eebbf6
3 changed files with 47 additions and 22 deletions
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Show Stats Download Patch File Download Diff File
  1. 63
      main/inc/lib/PortfolioController.php
  2. 2
      main/template/default/portfolio/items.html.twig
  3. 4
      main/template/default/portfolio/view.html.twig

63
main/inc/lib/PortfolioController.php
Unescape View File

@ -371,14 +371,18 @@ class PortfolioController
$form->addLabel(
sprintf(get_lang('PortfolioItemFromXUser'), $origin->getUser()->getCompleteName()),
Display::panel($origin->getContent())
Display::panel(
Security::remove_XSS($origin->getContent())
)
);
} elseif (Portfolio::TYPE_COMMENT === $item->getOriginType()) {
$origin = $this->em->find(PortfolioComment::class, $item->getOrigin());
$form->addLabel(
sprintf(get_lang('PortfolioCommentFromXUser'), $origin->getAuthor()->getCompleteName()),
Display::panel($origin->getContent())
Display::panel(
Security::remove_XSS($origin->getContent())
)
);
}
}
@ -694,7 +698,7 @@ class PortfolioController
}
$nodeHtml = '<p class="media-heading h4">'.PHP_EOL
.$comment->getAuthor()->getCompleteName().'</>'.PHP_EOL.'<small>'.$clockIcon.PHP_EOL
.$comment->getAuthor()->getCompleteName().PHP_EOL.'<small>'.$clockIcon.PHP_EOL
.Display::dateToStringAgoAndLongDate($comment->getDate()).'</small>'.PHP_EOL;
if ($comment->isImportant()
@ -707,7 +711,8 @@ class PortfolioController
$nodeHtml .= '</p>'.PHP_EOL
.'<div class="pull-right">'.implode(PHP_EOL, $commentActions).'</div>'
.$comment->getContent().PHP_EOL;
.Security::remove_XSS($comment->getContent())
.PHP_EOL;
$nodeHtml .= $this->generateAttachmentList($comment);
@ -735,7 +740,7 @@ class PortfolioController
$this->baseUrl
);
$this->renderView($content, $item->getTitle(), $actions, false);
$this->renderView($content, Security::remove_XSS($item->getTitle()), $actions, false);
}
/**
@ -826,7 +831,9 @@ class PortfolioController
$form->addLabel(
sprintf(get_lang('PortfolioItemFromXUser'), $originItem->getUser()->getCompleteName()),
Display::panel($originItem->getContent())
Display::panel(
Security::remove_XSS($originItem->getContent())
)
);
$form->addHtmlEditor('content', get_lang('Content'), true, false, ['ToolbarSet' => 'NotebookStudent']);
@ -915,7 +922,9 @@ class PortfolioController
$form->addLabel(
sprintf(get_lang('PortfolioCommentFromXUser'), $originComment->getAuthor()->getCompleteName()),
Display::panel($originComment->getContent())
Display::panel(
Security::remove_XSS($originComment->getContent())
)
);
$form->addHtmlEditor('content', get_lang('Content'), true, false, ['ToolbarSet' => 'NotebookStudent']);
@ -1160,7 +1169,7 @@ class PortfolioController
$portfolioItemColumnFilter = function (Portfolio $item) {
return Display::url(
$item->getTitle(),
Security::remove_XSS($item->getTitle()),
$this->baseUrl.http_build_query(['action' => 'view', 'id' => $item->getId()])
);
};
@ -1263,7 +1272,7 @@ class PortfolioController
0,
function (PortfolioComment $comment) {
return Display::url(
$comment->getContent(),
$comment->getExcerpt(),
$this->baseUrl.http_build_query(['action' => 'view', 'id' => $comment->getItem()->getId()])
.'#comment-'.$comment->getId()
);
@ -1458,7 +1467,9 @@ class PortfolioController
$form->addUserAvatar('user', get_lang('Author'));
$form->addLabel(get_lang('Title'), $item->getTitle());
$itemContent = $this->generateItemContent($item);
$itemContent = Security::remove_XSS(
$this->generateItemContent($item)
);
$form->addLabel(get_lang('Content'), $itemContent);
$form->addNumeric(
@ -1495,7 +1506,7 @@ class PortfolioController
'url' => $this->baseUrl,
];
$interbreadcrumb[] = [
'name' => $item->getTitle(),
'name' => Security::remove_XSS($item->getTitle()),
'url' => $this->baseUrl.http_build_query(['action' => 'view', 'id' => $item->getId()]),
];
@ -1564,7 +1575,7 @@ class PortfolioController
'url' => $this->baseUrl,
];
$interbreadcrumb[] = [
'name' => $item->getTitle(),
'name' => Security::remove_XSS($item->getTitle()),
'url' => $this->baseUrl.http_build_query(['action' => 'view', 'id' => $item->getId()]),
];
@ -1759,7 +1770,7 @@ class PortfolioController
$attachment = new PortfolioAttachment();
$attachment
->setFilename($_file['name'])
->setComment(Security::remove_XSS($comments[$i]))
->setComment($comments[$i])
->setPath($newFileName)
->setOrigin($originId)
->setOriginType($originType)
@ -1808,14 +1819,20 @@ class PortfolioController
$listItems .= '<li>'
.'<span class="fa-li fa fa-paperclip" aria-hidden="true"></span>'
.Display::url($attachment->getFilename(), $this->baseUrl.$downloadParams);
.Display::url(
Security::remove_XSS($attachment->getFilename()),
$this->baseUrl.$downloadParams
);
if ($currentUserId === $postOwnerId) {
$listItems .= PHP_EOL.Display::url($deleteIcon, $this->baseUrl.$deleteParams);
}
if ($attachment->getComment()) {
$listItems .= PHP_EOL.Display::span($attachment->getComment(), ['class' => 'text-muted']);
$listItems .= PHP_EOL.Display::span(
Security::remove_XSS($attachment->getComment()),
['class' => 'text-muted']
);
}
$listItems .= '</li>';
@ -2196,9 +2213,11 @@ class PortfolioController
$metadata .= '</ul>';
$itemContent = $this->generateItemContent($item);
$itemContent = Security::remove_XSS(
$this->generateItemContent($item)
);
$itemsHtml[] = Display::panel($itemContent, $item->getTitle(), '', 'info', $metadata);
$itemsHtml[] = Display::panel($itemContent, Security::remove_XSS($item->getTitle()), '', 'info', $metadata);
}
return $itemsHtml;
@ -2239,10 +2258,16 @@ class PortfolioController
$metadata = '<ul class="list-unstyled text-muted">';
$metadata .= '<li>'.sprintf(get_lang('DateXDate'), $date).'</li>';
$metadata .= '<li>'.sprintf(get_lang('PortfolioItemTitleXName'), $item->getTitle()).'</li>';
$metadata .= '<li>'.sprintf(get_lang('PortfolioItemTitleXName'), Security::remove_XSS($item->getTitle())).'</li>';
$metadata .= '</ul>';
$commentsHtml[] = Display::panel($comment->getContent(), '', '', 'default', $metadata);
$commentsHtml[] = Display::panel(
Security::remove_XSS($comment->getContent()),
'',
'',
'default',
$metadata
);
}
return $commentsHtml;

2
main/template/default/portfolio/items.html.twig
Unescape View File

@ -33,7 +33,7 @@
{% endif %}
<h3>
<a href="{{ item_url }}">{{ item.title }}</a>
<a href="{{ item_url }}">{{ item.title|remove_xss }}</a>
</h3>
<ul class="fa-ul list-inline">

4
main/template/default/portfolio/view.html.twig
Unescape View File

@ -38,7 +38,7 @@
{% endif %}
</div>
<h4 class="h3">{{ item.title }}</h4>
<h4 class="h3">{{ item.title|remove_xss }}</h4>
<ul class="fa-ul list-inline">
{% if _c is empty %}
@ -80,7 +80,7 @@
<hr>
{{ item_content }}
{{ item_content|remove_xss }}
{% if attachment_list %}
<hr>

Write Preview
Loading…
Cancel
Save