proxmox-mirrors/pve-manager
1
0
Fork 0
mirror of https://git.proxmox.com/git/pve-manager synced 2025-05-01 17:11:40 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

ui: fix missing htmlEncodes

Browse Source 
username can include some special characters, so we have
to escape them

backport from pve6

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
This commit is contained in:
Dominik Csapak 2020-05-12 12:11:08 +02:00 committed by Thomas Lamprecht
parent e5bdba1d9c
commit 74f2df2f5f
9 changed files with 11 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
www/manager6/Workspace.js
View File

@ -170,7 +170,7 @@ Ext.define('PVE.StdWorkspace', {
var ui = me.query('#userinfo')[0]; var ui = me.query('#userinfo')[0];
if (Proxmox.UserName) { if (Proxmox.UserName) {
var msg = Ext.String.format(gettext("You are logged in as {0}"), "'" + Proxmox.UserName + "'"); var msg = Ext.String.format(gettext("You are logged in as {0}"), "'" + Ext.String.htmlEncode(Proxmox.UserName) + "'");
ui.update('<div class="x-unselectable" style="white-space:nowrap;">' + msg + '</div>'); ui.update('<div class="x-unselectable" style="white-space:nowrap;">' + msg + '</div>');
} else { } else {
ui.update(''); ui.update('');

2
www/manager6/dc/ACLView.js
View File

@ -111,7 +111,7 @@ Ext.define('PVE.dc.ACLView', {
return '@' + ugid; return '@' + ugid;
} }
return ugid; return Ext.String.htmlEncode(ugid);
}; };
var columns = [ var columns = [

2
www/manager6/dc/Log.js
View File

@ -68,6 +68,7 @@ Ext.define('PVE.dc.Log', {
{ {
header: gettext("User name"), header: gettext("User name"),
dataIndex: 'user', dataIndex: 'user',
renderer: Ext.String.htmlEncode,
width: 150 width: 150
}, },
{ {
@ -79,6 +80,7 @@ Ext.define('PVE.dc.Log', {
{ {
header: gettext("Message"), header: gettext("Message"),
dataIndex: 'msg', dataIndex: 'msg',
renderer: Ext.String.htmlEncode,
flex: 1 flex: 1
} }
], ],

1
www/manager6/dc/TFAEdit.js
View File

@ -368,6 +368,7 @@ Ext.define('PVE.window.TFAEdit', {
{ {
xtype: 'displayfield', xtype: 'displayfield',
fieldLabel: gettext('User name'), fieldLabel: gettext('User name'),
renderer: Ext.String.htmlEncode,
cbind: { cbind: {
value: '{userid}' value: '{userid}'
} }

1
www/manager6/dc/Tasks.js
View File

@ -101,6 +101,7 @@ Ext.define('PVE.dc.Tasks', {
{ {
header: gettext("User name"), header: gettext("User name"),
dataIndex: 'user', dataIndex: 'user',
renderer: Ext.String.htmlEncode,
width: 150 width: 150
}, },
{ {

1
www/manager6/dc/UserEdit.js
View File

@ -72,6 +72,7 @@ Ext.define('PVE.dc.UserEdit', {
name: 'userid', name: 'userid',
fieldLabel: gettext('User name'), fieldLabel: gettext('User name'),
value: me.userid, value: me.userid,
renderer: Ext.String.htmlEncode,
allowBlank: false, allowBlank: false,
submitValue: me.isCreate ? true : false submitValue: me.isCreate ? true : false
}, },

4
www/manager6/dc/UserView.js
View File

@ -110,11 +110,11 @@ Ext.define('PVE.dc.UserView', {
]; ];
var render_username = function(userid) { var render_username = function(userid) {
return userid.match(/^(.+)(@[^@]+)$/)[1]; return Ext.String.htmlEncode(userid.match(/^(.+)(@[^@]+)$/)[1]);
}; };
var render_realm = function(userid) { var render_realm = function(userid) {
return userid.match(/@([^@]+)$/)[1]; return Ext.String.htmlEncode(userid.match(/@([^@]+)$/)[1]);
}; };
Ext.apply(me, { Ext.apply(me, {

1
www/manager6/form/UserSelector.js
View File

@ -29,6 +29,7 @@ Ext.define('PVE.form.UserSelector', {
header: gettext('User'), header: gettext('User'),
sortable: true, sortable: true,
dataIndex: 'userid', dataIndex: 'userid',
renderer: Ext.String.htmlEncode,
flex: 1 flex: 1
}, },
{ {

2
www/manager6/window/Settings.js
View File

@ -36,7 +36,7 @@ Ext.define('PVE.window.Settings', {
var sp = Ext.state.Manager.getProvider(); var sp = Ext.state.Manager.getProvider();
var username = sp.get('login-username') || Proxmox.Utils.noneText; var username = sp.get('login-username') || Proxmox.Utils.noneText;
me.lookupReference('savedUserName').setValue(username); me.lookupReference('savedUserName').setValue(Ext.String.htmlEncode(username));
var settings = ['fontSize', 'fontFamily', 'letterSpacing', 'lineHeight']; var settings = ['fontSize', 'fontFamily', 'letterSpacing', 'lineHeight'];
settings.forEach(function(setting) { settings.forEach(function(setting) {