proxmox-mirrors/proxmox-widget-toolkit
1
0
Fork 1
mirror of https://git.proxmox.com/git/proxmox-widget-toolkit synced 2025-05-06 23:40:51 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

utils: always html-encode response message

Browse Source 
while this is something that only the user that made the request will
see, and for most people the possibility of "hacking" themselves is
rather redundant, it is still not nice to have this possible in
general; as even if it's highly unlikely that there ever can be an
error triggered to another user via API2 request handling, hardening
against it is simply to cheap to not do it.

Reported-by: Marcel Fromkorth <marcel.fromkorth@8com.de>
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
This commit is contained in:
Thomas Lamprecht 2023-01-31 15:41:39 +01:00
parent d53046d66b
commit cf93d1da50
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/Utils.js
View File

@ -396,7 +396,7 @@ utilities: {
if (!result.success) {
msg = gettext("Unknown error");
if (result.message) {
msg = result.message;
msg = Ext.htmlEncode(result.message);
if (result.status) {
msg += ` (${result.status})`;
}