beenull/sftpgo-mirror
1
0
Fork 0
mirror of https://github.com/drakkan/sftpgo.git synced 2024-11-21 23:20:24 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 6

WebAdmin: ensure to sanitize data before rendering

Browse source 
Thanks to Polina Zvorykina, VK for reporting this issue

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
This commit is contained in:
Nicola Murino 2023-03-28 12:28:38 +02:00
parent b60d3f680e
commit 084d4109b8
No known key found for this signature in database
GPG key ID: 935D2952DEC4EECF
4 changed files with 20 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
go.mod
View file

@ -158,7 +158,7 @@ require (
golang.org/x/tools v0.7.0 // indirect
golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
google.golang.org/appengine v1.6.7 // indirect
google.golang.org/genproto v0.0.0-20230323212658-478b75c54725 // indirect
google.golang.org/genproto v0.0.0-20230327215041-6ac7f18bb9d5 // indirect
google.golang.org/grpc v1.54.0 // indirect
google.golang.org/protobuf v1.30.0 // indirect
gopkg.in/ini.v1 v1.67.0 // indirect

4
go.sum
View file

@ -2805,8 +2805,8 @@ google.golang.org/genproto v0.0.0-20230113154510-dbe35b8444a5/go.mod h1:RGgjbofJ
google.golang.org/genproto v0.0.0-20230124163310-31e0e69b6fc2/go.mod h1:RGgjbofJ8xD9Sq1VVhDM1Vok1vRONV+rg+CjzG4SZKM=
google.golang.org/genproto v0.0.0-20230125152338-dcaf20b6aeaa/go.mod h1:RGgjbofJ8xD9Sq1VVhDM1Vok1vRONV+rg+CjzG4SZKM=
google.golang.org/genproto v0.0.0-20230209215440-0dfe4f8abfcc/go.mod h1:RGgjbofJ8xD9Sq1VVhDM1Vok1vRONV+rg+CjzG4SZKM=
google.golang.org/genproto v0.0.0-20230323212658-478b75c54725 h1:VmCWItVXcKboEMCwZaWge+1JLiTCQSngZeINF+wzO+g=
google.golang.org/genproto v0.0.0-20230323212658-478b75c54725/go.mod h1:UUQDJDOlWu4KYeJZffbWgBkS1YFobzKbLVfK69pe0Ak=
google.golang.org/genproto v0.0.0-20230327215041-6ac7f18bb9d5 h1:Kd6tRRHXw8z4TlPlWi+NaK10gsePL6GdZBQChptOLGA=
google.golang.org/genproto v0.0.0-20230327215041-6ac7f18bb9d5/go.mod h1:UUQDJDOlWu4KYeJZffbWgBkS1YFobzKbLVfK69pe0Ak=
google.golang.org/grpc v0.0.0-20160317175043-d3ddb4469d5a/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=

20
templates/webadmin/events.html
View file

@ -403,7 +403,7 @@ along with this program. If not, see <https://www.gnu.org/licenses/>.
"data": "object_type",
"render": function (data, type, row) {
if (type === 'display') {
let ellipsisFn = $.fn.dataTable.render.ellipsis(70, true);
let ellipsisFn = $.fn.dataTable.render.ellipsis(70, true, true);
return ellipsisFn(`${data}: ${row["object_name"]}`,type);
}
return data;
@ -411,7 +411,13 @@ along with this program. If not, see <https://www.gnu.org/licenses/>.
},
{
"data": "username",
"defaultContent": ""
"defaultContent": "",
"render": function (data, type, row) {
if (type === 'display') {
return escapeHTML(data);
}
return data;
}
},
{
"data": "ip",
@ -486,7 +492,7 @@ along with this program. If not, see <https://www.gnu.org/licenses/>.
"data": "virtual_path",
"render": function (data, type, row) {
if (type === 'display') {
let ellipsisFn = $.fn.dataTable.render.ellipsis(70, true);
let ellipsisFn = $.fn.dataTable.render.ellipsis(70, true, true);
if (row["virtual_target_path"]){
return ellipsisFn(`${data} => ${row["virtual_target_path"]}`,type);
}
@ -497,7 +503,13 @@ along with this program. If not, see <https://www.gnu.org/licenses/>.
},
{
"data": "username",
"defaultContent": ""
"defaultContent": "",
"render": function (data, type, row) {
if (type === 'display') {
return escapeHTML(data);
}
return data;
}
},
{
"data": "protocol",

2
templates/webadmin/iplists.html
View file

@ -455,7 +455,7 @@ $(document).ready(function () {
"data": "description",
"render": function (data, type, row) {
if (type === 'display') {
let ellipsisFn = $.fn.dataTable.render.ellipsis(70, true);
let ellipsisFn = $.fn.dataTable.render.ellipsis(70, true, true);
return ellipsisFn(data,type);
}
return data;