github-jwinterm/modoboa
1
0
Fork 0
mirror of https://github.com/jwinterm/modoboa.git synced 2026-10-17 05:41:25 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fixed XSS issue in domain creation form.

Browse Source
This commit is contained in:
Antoine Nguyen
2023-01-23 11:14:21 +01:00
parent 8313dba88f
commit c1db80fa69
3 changed files with 15 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modoboa/admin/static/admin/js/admin.js
+1 -1
View File
@@ -295,7 +295,7 @@ Domains.prototype = {
optionsform_prefill: function() {
var $span = $("#id_dom_admin_username").next("span");
$span.html("@" + $("#id_name").val());
$span.html("@" + htmlEncode($("#id_name").val()));
},
domadminsform_init: function() {
modoboa/admin/templates/admin/domains.html
+5 -5
View File
@@ -13,11 +13,11 @@
{{ block.super }}
<script src="{% static 'transport/js/transport.js' %}" type="text/javascript"></script>
<script type="text/javascript">
$(document).ready(function() {
admin = new Domains({
load_page_url: "{% url 'admin:domain_page' %}"
});
});
$(document).ready(function() {
admin = new Domains({
load_page_url: "{% url 'admin:domain_page' %}"
});
});
</script>
{% extra_static_content "domains" "js" user %}
{% endblock %}
modoboa/static/js/global.js
+9
View File
@@ -361,6 +361,15 @@ String.prototype.format = function() {
});
};
/**
* Simple HTML escape function
*/
function htmlEncode(str) {
return String(str).replace(/[^\w. ]/gi, function(c) {
return '&#'+c.charCodeAt(0)+';';
});
}
$(document).ready(function() {
$(document).ajaxSuccess(function(e, xhr, settings) { ajax_login_redirect(xhr); });
$(document).ajaxError(defaultAjaxErrorHandler);