Skip to content

Commit 5e353be

Browse files
aemblerKorvinSzanto
aembler
authored and
KorvinSzanto
committed
Merge pull request #10996 from KorvinSzanto/feature/clean-up-xss
Prevent browser blocked reflected XSS in dashboard search pages
1 parent 2cf7546 commit 5e353be

11 files changed

Lines changed: 15 additions & 13 deletions

File tree

‎concrete/blocks/express_entry_list/view.php‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,8 @@
88
<?php } ?>
99
<?php if ($tableDescription) { ?>
1010
<p><?=$tableDescription?></p>
11-
<?php }
12-
11+
<?php }
12+
1313
if (isset($entity)) { ?>
1414
<?php if ($enableSearch) { ?>
1515
<form method="get" action="<?=$c->getCollectionLink()?>">
@@ -87,7 +87,9 @@ class="table ccm-block-express-entry-list-table <?php if ($tableStriped) { ?><?p
8787
<thead>
8888
<tr>
8989
<?php foreach ($result->getColumns() as $column) { ?>
90-
<th class="<?=$column->getColumnStyleClass()?>"><a href="<?=$column->getColumnSortURL()?>"><?=$column->getColumnTitle()?></a></th>
90+
<th class="<?=$column->getColumnStyleClass()?>">
91+
<a href="<?=h($column->getColumnSortURL())?>"><?=$column->getColumnTitle()?></a>
92+
</th>
9193
<?php } ?>
9294
</tr>
9395
</thead>

‎concrete/elements/express/search/menu.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
?>
2525
<li data-items-per-page="<?= $itemsPerPageOption; ?>">
2626
<a class="dropdown-item <?= ($itemsPerPageOption === $itemsPerPage) ? 'active' : ''; ?>"
27-
href="<?=$url?>"><?= $itemsPerPageOption; ?></a>
27+
href="<?= h($url) ?>"><?= $itemsPerPageOption; ?></a>
2828
</li>
2929
<?php } ?>
3030
</ul>

‎concrete/elements/files/search/menu.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ class="btn btn-secondary p-2 dropdown-toggle"
3838
?>
3939

4040
<li data-items-per-page="<?php echo $itemsPerPageOption; ?>">
41-
<a class="dropdown-item <?php echo ($itemsPerPageOption === $itemsPerPage) ? 'active' : ''; ?>" href="<?php echo $url ?>">
41+
<a class="dropdown-item <?php echo ($itemsPerPageOption === $itemsPerPage) ? 'active' : ''; ?>" href="<?php echo h($url) ?>">
4242
<?php echo $itemsPerPageOption; ?>
4343
</a>
4444
</li>

‎concrete/elements/groups/search/menu.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ class="btn btn-secondary p-2 dropdown-toggle"
4646

4747
<li data-items-per-page="<?php echo $itemsPerPageOption; ?>">
4848
<a class="dropdown-item <?php echo ($itemsPerPageOption === $itemsPerPage) ? 'active' : ''; ?>"
49-
href="<?php echo $url ?>">
49+
href="<?php echo h($url) ?>">
5050
<?php echo $itemsPerPageOption; ?>
5151
</a>
5252
</li>

‎concrete/elements/pages/search/menu.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ class="btn btn-secondary p-2 dropdown-toggle"
3636

3737
<li data-items-per-page="<?php echo $itemsPerPageOption; ?>">
3838
<a class="dropdown-item <?php echo ($itemsPerPageOption === $itemsPerPage) ? 'active' : ''; ?>"
39-
href="<?php echo $url ?>">
39+
href="<?php echo h($url) ?>">
4040
<?php echo $itemsPerPageOption; ?>
4141
</a>
4242
</li>

‎concrete/elements/users/search/menu.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ class="btn btn-secondary p-2 dropdown-toggle"
3838

3939
<li data-items-per-page="<?php echo $itemsPerPageOption; ?>">
4040
<a class="dropdown-item <?php echo ($itemsPerPageOption === $itemsPerPage) ? 'active' : ''; ?>"
41-
href="<?php echo $url ?>">
41+
href="<?php echo h($url) ?>">
4242
<?php echo $itemsPerPageOption; ?>
4343
</a>
4444
</li>

‎concrete/single_pages/dashboard/express/entries/entries.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
<?php foreach ($result->getColumns() as $column) { ?>
1515
<th class="<?=$column->getColumnStyleClass()?>">
1616
<?php if ($column->isColumnSortable()) { ?>
17-
<a href="<?=$column->getColumnSortURL()?>"><?=$column->getColumnTitle()?></a>
17+
<a href="<?= h($column->getColumnSortURL()) ?>"><?=$column->getColumnTitle()?></a>
1818
<?php } else { ?>
1919
<span><?=$column->getColumnTitle()?></span>
2020
<?php } ?>

‎concrete/single_pages/dashboard/files/search.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ class="btn btn-secondary dropdown-toggle dropdown-toggle-split"
6868
<?php
6969
if ($column->isColumnSortable()) { ?>
7070
<a href="<?php
71-
echo $column->getColumnSortURL() ?>">
71+
echo h($column->getColumnSortURL()) ?>">
7272
<?php
7373
echo $column->getColumnTitle() ?>
7474
</a>

‎concrete/single_pages/dashboard/sitemap/search.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ class="btn btn-secondary dropdown-toggle dropdown-toggle-split"
5353
<?php /** @var Column $column */ ?>
5454
<th class="<?php echo $column->getColumnStyleClass() ?>">
5555
<?php if ($column->isColumnSortable()): ?>
56-
<a href="<?php echo $column->getColumnSortURL() ?>">
56+
<a href="<?php echo h($column->getColumnSortURL()) ?>">
5757
<?php echo $column->getColumnTitle() ?>
5858
</a>
5959
<?php else: ?>

‎concrete/single_pages/dashboard/users/groups.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ class="btn btn-secondary dropdown-toggle dropdown-toggle-split"
5353
<?php /** @var Column $column */ ?>
5454
<th class="<?php echo $column->getColumnStyleClass() ?>">
5555
<?php if ($column->isColumnSortable()): ?>
56-
<a href="<?php echo $column->getColumnSortURL() ?>">
56+
<a href="<?php echo h($column->getColumnSortURL()) ?>">
5757
<?php echo $column->getColumnTitle() ?>
5858
</a>
5959
<?php else: ?>

0 commit comments

Comments
 (0)
⚡