Mirrors/invoiceninja
1
0
Fork 0
mirror of https://github.com/invoiceninja/invoiceninja.git synced 2024-11-08 12:12:48 +01:00
Code Issues Releases Activity

XSS fixes

Browse Source
This commit is contained in:
Hillel Coren 2019-04-17 18:29:09 +03:00
parent a1d781c435
commit 40621823dc
3 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
app/Libraries/Utils.php
View File

@ -1199,6 +1199,7 @@ class Utils
return '';
}
$link = e($link);
$title = $link;
if (substr($link, 0, 4) != 'http') {
$link = 'http://' . $link;

2
app/Ninja/Datatables/ActivityDatatable.php
View File

@ -45,7 +45,7 @@ class ActivityDatatable extends EntityDatatable
'invoice' => $model->invoice ? link_to('/invoices/' . $model->invoice_public_id, $model->is_recurring ? trans('texts.recurring_invoice') : $model->invoice)->toHtml() : null,
'quote' => $model->invoice ? link_to('/quotes/' . $model->invoice_public_id, $model->invoice)->toHtml() : null,
'contact' => $model->contact_id ? link_to('/clients/' . $model->client_public_id, Utils::getClientDisplayName($model))->toHtml() : Utils::getPersonDisplayName($model->user_first_name, $model->user_last_name, $model->user_email),
'payment' => $model->payment ?: '',
'payment' => $model->payment ? e($model->payment) : '',
'credit' => $model->payment_amount ? Utils::formatMoney($model->credit, $model->currency_id, $model->country_id) : '',
'payment_amount' => $model->payment_amount ? Utils::formatMoney($model->payment_amount, $model->currency_id, $model->country_id) : null,
'adjustment' => $model->adjustment ? Utils::formatMoney($model->adjustment, $model->currency_id, $model->country_id) : null,

5
app/Ninja/Presenters/ClientPresenter.php
View File

@ -32,9 +32,10 @@ class ClientPresenter extends EntityPresenter
return '';
}
$link = Utils::addHttp($client->website);
$website = e($client->website);
$link = Utils::addHttp($website);
return link_to($link, $client->website, ['target' => '_blank']);
return link_to($link, $website, ['target' => '_blank']);
}
public function paid_to_date()