Mirrors/invoiceninja
1
0
Fork 0
mirror of https://github.com/invoiceninja/invoiceninja.git synced 2024-09-19 16:01:34 +02:00
Code Issues Releases Activity

Improve JSON encoding in HTML

Browse Source
This commit is contained in:
Hillel Coren 2017-05-07 10:00:38 +03:00
parent 2cacec4d6c
commit 42032f5e9a
20 changed files with 48 additions and 35 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
app/Http/Requests/SaveClientPortalSettings.php
View File

@ -38,7 +38,7 @@ class SaveClientPortalSettings extends Request
$input = $this->all();
if ($this->client_view_css && Utils::isNinja()) {
$input['client_view_css'] = HTMLUtils::sanitize($this->client_view_css);
$input['client_view_css'] = HTMLUtils::sanitizeCSS($this->client_view_css);
}
if (Utils::isNinja()) {
@ -53,7 +53,7 @@ class SaveClientPortalSettings extends Request
$input['subdomain'] = null;
}
}
$this->replace($input);
return $this->all();

15
app/Libraries/HTMLUtils.php
View File

@ -7,7 +7,7 @@ use HTMLPurifier_Config;
class HTMLUtils
{
public static function sanitize($css)
public static function sanitizeCSS($css)
{
// Allow referencing the body element
$css = preg_replace('/(?<![a-z0-9\-\_\#\.])body(?![a-z0-9\-\_])/i', '.body', $css);
@ -36,4 +36,17 @@ class HTMLUtils
// Get the first style block
return count($css) ? $css[0] : '';
}
public static function sanitizeHTML($html)
{
$config = HTMLPurifier_Config::createDefault();
$purifier = new HTMLPurifier($config);
return $purifier->purify($html);
}
public static function encodeJSON($string)
{
return htmlentities(json_encode($string), ENT_NOQUOTES);
}
}

2
resources/views/accounts/client_portal.blade.php
View File

@ -372,7 +372,7 @@ iframe.src = '{{ rtrim(SITE_URL ,'/') }}/view/'
<script type="text/javascript">
var products = {!! strip_tags(json_encode($products)) !!};
var products = {!! HTMLUtils::encodeJSON($products) !!};
$(function() {
var $productSelect = $('select#product');

2
resources/views/accounts/invoice_design.blade.php
View File

@ -22,7 +22,7 @@
<script>
var invoiceDesigns = {!! $invoiceDesigns !!};
var invoiceFonts = {!! $invoiceFonts !!};
var invoice = {!! strip_tags(json_encode($invoice)) !!};
var invoice = {!! HTMLUtils::encodeJSON($invoice) !!};
function getDesignJavascript() {
var id = $('#invoice_design_id').val();

2
resources/views/accounts/payments.blade.php
View File

@ -200,7 +200,7 @@
<script>
window.onDatatableReady = actionListHandler;
var taxRates = {!! strip_tags(json_encode($taxRates)) !!};
var taxRates = {!! HTMLUtils::encodeJSON($taxRates) !!};
var taxRatesMap = {};
for (var i=0; i<taxRates.length; i++) {
var taxRate = taxRates[i];

2
resources/views/accounts/templates_and_reminders.blade.php
View File

@ -151,7 +151,7 @@
var entityTypes = ['invoice', 'quote', 'payment', 'reminder1', 'reminder2', 'reminder3'];
var stringTypes = ['subject', 'template'];
var templates = {!! json_encode($defaultTemplates) !!};
var account = {!! strip_tags(json_encode(Auth::user()->account)) !!};
var account = {!! HTMLUtils::encodeJSON(Auth::user()->account) !!};
function refreshPreview() {
for (var i=0; i<entityTypes.length; i++) {

4
resources/views/clients/statement.blade.php
View File

@ -13,8 +13,8 @@
var invoiceDesigns = {!! \App\Models\InvoiceDesign::getDesigns() !!};
var invoiceFonts = {!! Cache::get('fonts') !!};
var currentInvoice = {!! strip_tags(json_encode($invoice)) !!};
var invoice = {!! strip_tags(json_encode($invoice)) !!};
var currentInvoice = {!! HTMLUtils::encodeJSON($invoice) !!};
var invoice = {!! HTMLUtils::encodeJSON($invoice) !!};
function getPDFString(cb) {

2
resources/views/credits/edit.blade.php
View File

@ -58,7 +58,7 @@
<script type="text/javascript">
var clients = {!! $clients ? strip_tags(json_encode($clients)) : 'false' !!};
var clients = {!! $clients ? HTMLUtils::encodeJSON($clients) : 'false' !!};
$(function() {

2
resources/views/dashboard.blade.php
View File

@ -83,7 +83,7 @@
}
}
var account = {!! strip_tags(json_encode($account)) !!};
var account = {!! HTMLUtils::encodeJSON($account) !!};
var chartGroupBy = 'day';
var chartCurrencyId = {{ $account->getCurrencyId() }};
var dateRanges = {!! $account->present()->dateRangeOptions !!};

8
resources/views/expenses/edit.blade.php
View File

@ -256,10 +256,10 @@
<script type="text/javascript">
Dropzone.autoDiscover = false;
var vendors = {!! strip_tags(json_encode($vendors)) !!};
var clients = {!! strip_tags(json_encode($clients)) !!};
var categories = {!! strip_tags(json_encode($categories)) !!};
var taxRates = {!! strip_tags(json_encode($taxRates)) !!};
var vendors = {!! HTMLUtils::encodeJSON($vendors) !!};
var clients = {!! HTMLUtils::encodeJSON($clients) !!};
var categories = {!! HTMLUtils::encodeJSON($categories) !!};
var taxRates = {!! HTMLUtils::encodeJSON($taxRates) !!};
var clientMap = {};
var vendorMap = {};

12
resources/views/invoices/edit.blade.php
View File

@ -841,8 +841,8 @@
<script type="text/javascript">
Dropzone.autoDiscover = false;
var products = {!! strip_tags(json_encode($products)) !!};
var clients = {!! strip_tags(json_encode($clients)) !!};
var products = {!! HTMLUtils::encodeJSON($products) !!};
var clients = {!! HTMLUtils::encodeJSON($clients) !!};
var account = {!! Auth::user()->account !!};
var dropzone;
@ -882,7 +882,7 @@
// otherwise create blank model
window.model = new ViewModel();
var invoice = {!! strip_tags(json_encode($invoice)) !!};
var invoice = {!! HTMLUtils::encodeJSON($invoice) !!};
ko.mapping.fromJS(invoice, model.invoice().mapping, model.invoice);
model.invoice().is_recurring({{ $invoice->is_recurring ? '1' : '0' }});
model.invoice().start_date_orig(model.invoice().start_date());
@ -900,7 +900,7 @@
@else
// set the default account tax rate
@if ($account->invoice_taxes && ! empty($defaultTax))
var defaultTax = {!! strip_tags(json_encode($defaultTax)) !!};
var defaultTax = {!! HTMLUtils::encodeJSON($defaultTax) !!};
model.invoice().tax_rate1(defaultTax.rate);
model.invoice().tax_name1(defaultTax.name);
@endif
@ -909,7 +909,7 @@
@if (isset($tasks) && $tasks)
// move the blank invoice line item to the end
var blank = model.invoice().invoice_items.pop();
var tasks = {!! strip_tags(json_encode($tasks)) !!};
var tasks = {!! HTMLUtils::encodeJSON($tasks) !!};
for (var i=0; i<tasks.length; i++) {
var task = tasks[i];
@ -928,7 +928,7 @@
// move the blank invoice line item to the end
var blank = model.invoice().invoice_items.pop();
var expenses = {!! strip_tags(json_encode($expenses)) !!}
var expenses = {!! HTMLUtils::encodeJSON($expenses) !!}
for (var i=0; i<expenses.length; i++) {
var expense = expenses[i];

2
resources/views/invoices/history.blade.php
View File

@ -13,7 +13,7 @@
var invoiceDesigns = {!! $invoiceDesigns !!};
var invoiceFonts = {!! $invoiceFonts !!};
var currentInvoice = {!! strip_tags(json_encode($invoice)) !!};
var currentInvoice = {!! HTMLUtils::encodeJSON($invoice) !!};
var versionsJson = {!! strip_tags($versionsJson) !!};
function getPDFString(cb) {

4
resources/views/invoices/knockout.blade.php
View File

@ -7,7 +7,7 @@ function ViewModel(data) {
//self.invoice = data ? false : new InvoiceModel();
self.invoice = ko.observable(data ? false : new InvoiceModel());
self.expense_currency_id = ko.observable();
self.products = {!! strip_tags(json_encode($products)) !!};
self.products = {!! HTMLUtils::encodeJSON($products) !!};
self.loadClient = function(client) {
ko.mapping.fromJS(client, model.invoice().client().mapping, model.invoice().client);
@ -174,7 +174,7 @@ function InvoiceModel(data) {
var self = this;
this.client = ko.observable(clientModel);
this.is_public = ko.observable(0);
self.account = {!! strip_tags(json_encode($account)) !!};
self.account = {!! HTMLUtils::encodeJSON($account) !!};
self.id = ko.observable('');
self.discount = ko.observable('');
self.is_amount_discount = ko.observable(0);

2
resources/views/invoices/pdf.blade.php
View File

@ -102,7 +102,7 @@
NINJA.bodyFont = "Roboto";
@endif
var invoiceLabels = {!! strip_tags(json_encode($account->getInvoiceLabels())) !!};
var invoiceLabels = {!! HTMLUtils::encodeJSON($account->getInvoiceLabels()) !!};
if (window.invoice) {
//invoiceLabels.item = invoice.has_tasks ? invoiceLabels.date : invoiceLabels.item_orig;

6
resources/views/invoices/view.blade.php
View File

@ -82,7 +82,7 @@
e.preventDefault();
$('#wepay-error').remove();
var email = {!! strip_tags(json_encode($contact->email)) !!} || prompt('{{ trans('texts.ach_email_prompt') }}');
var email = {!! HTMLUtils::encodeJSON($contact->email) !!} || prompt('{{ trans('texts.ach_email_prompt') }}');
if(!email)return;
WePay.bank_account.create({
@ -176,14 +176,14 @@
@endif
<script type="text/javascript">
window.invoice = {!! strip_tags(json_encode($invoice)) !!};
window.invoice = {!! HTMLUtils::encodeJSON($invoice) !!};
invoice.features = {
customize_invoice_design:{{ $invoice->client->account->hasFeature(FEATURE_CUSTOMIZE_INVOICE_DESIGN) ? 'true' : 'false' }},
remove_created_by:{{ $invoice->client->account->hasFeature(FEATURE_REMOVE_CREATED_BY) ? 'true' : 'false' }},
invoice_settings:{{ $invoice->client->account->hasFeature(FEATURE_INVOICE_SETTINGS) ? 'true' : 'false' }}
};
invoice.is_quote = {{ $invoice->isQuote() ? 'true' : 'false' }};
invoice.contact = {!! strip_tags(json_encode($contact)) !!};
invoice.contact = {!! HTMLUtils::encodeJSON($contact) !!};
function getPDFString(cb) {
return generatePDF(invoice, invoice.invoice_design.javascript, true, cb);

4
resources/views/payments/edit.blade.php
View File

@ -106,8 +106,8 @@
<script type="text/javascript">
var invoices = {!! strip_tags(json_encode($invoices)) !!};
var clients = {!! strip_tags(json_encode($clients)) !!};
var invoices = {!! HTMLUtils::encodeJSON($invoices) !!};
var clients = {!! HTMLUtils::encodeJSON($clients) !!};
$(function() {

2
resources/views/payments/paymentmethods_list.blade.php
View File

@ -58,7 +58,7 @@
e.preventDefault();
$('#wepay-error').remove();
var email = {!! strip_tags(json_encode($contact->email)) !!} || prompt('{{ trans('texts.ach_email_prompt') }}');
var email = {!! HTMLUtils::encodeJSON($contact->email) !!} || prompt('{{ trans('texts.ach_email_prompt') }}');
if(!email)return;
WePay.bank_account.create({

2
resources/views/projects/edit.blade.php
View File

@ -61,7 +61,7 @@
<script>
var clients = {!! strip_tags(json_encode($clients)) !!};
var clients = {!! HTMLUtils::encodeJSON($clients) !!};
$(function() {
var $clientSelect = $('select#client_id');

2
resources/views/reports/d3.blade.php
View File

@ -60,7 +60,7 @@
<script type="text/javascript">
// store data as JSON
var data = {!! strip_tags(json_encode($clients)) !!};
var data = {!! HTMLUtils::encodeJSON($clients) !!};
_.each(data, function(client) {
_.each(client.invoices, function(invoice) {

4
resources/views/tasks/edit.blade.php
View File

@ -232,8 +232,8 @@
}
}
var clients = {!! strip_tags(json_encode($clients)) !!};
var projects = {!! strip_tags(json_encode($projects)) !!};
var clients = {!! HTMLUtils::encodeJSON($clients) !!};
var projects = {!! HTMLUtils::encodeJSON($projects) !!};
var timeLabels = {};
@foreach (['hour', 'minute', 'second'] as $period)