Skip to content

Commit 4170a7f

Browse files
kanwarujjavalkanwarujjaval
authored
Merge pull request #4849 from Countly/event-xss
[SER-1080] Replace v-html in event templates
2 parents b858037 + c40c9ab commit 4170a7f

File tree

7 files changed

+32
-26
lines changed

7 files changed

+32
-26
lines changed

‎frontend/express/public/core/events/templates/allEvents.html

+3-3
Original file line numberDiff line numberDiff line change
@@ -39,8 +39,8 @@
3939
<div class="cly-vue-events-all" v-else>
4040
{{decode(groupData.name)}}<span class="cly-vue-events-group bu-ml-4">{{i18n('events.all.group')}}</span>
4141
</div>
42-
<div class="cly-vue-events-all__subheading bu-pt-3" v-if="groupData.isGroup && groupData.description" v-html="groupData.description"></div>
43-
<div class="cly-vue-events-all__subheading bu-pt-3" v-if="!groupData.isGroup && eventDescription" v-html="eventDescription"></div>
42+
<div class="cly-vue-events-all__subheading bu-pt-3" v-if="groupData.isGroup && groupData.description" >{{unescapeHtml(groupData.description)}}</div>
43+
<div class="cly-vue-events-all__subheading bu-pt-3" v-if="!groupData.isGroup && eventDescription" >{{unescapeHtml(eventDescription)}}</div>
4444
<div class="bu-is-flex cly-vue-events-all--padding">
4545
<div class="bu-is-align-items-center bu-is-flex" v-if="hasSegments">
4646
<span class="bu-is-flex cly-vue-events-all-placeholder-text bu-pr-2">{{i18n('events.all.segmentation')}}</span>
@@ -69,7 +69,7 @@
6969
<cly-date-picker-g class="cly-vue-events-all-date-picker"></cly-date-picker-g>
7070
</div>
7171
</div>
72-
<div class="color-cool-gray-100 font-weight-normal text-medium bu-pt-4" v-if="segmentDescription!=''" v-html="segmentDescription"></div>
72+
<div class="color-cool-gray-100 font-weight-normal text-medium bu-pt-4" v-if="segmentDescription!=''" >{{unescapeHtml(segmentDescription)}}</div>
7373
<cly-section class="bu-mt-5 bu-mr-5">
7474
<cly-chart-bar v-if="currentActiveSegmentation !== 'segment'" :option="barData" :legend="lineLegend" :force-loading="isChartLoading" v-loading="isChartLoading">
7575
</cly-chart-bar>

‎plugins/data-manager/frontend/public/javascripts/countly.views.js

+10-5
Original file line numberDiff line numberDiff line change
@@ -321,7 +321,8 @@
321321
template: CV.T('/data-manager/templates/event-group-detail.html'),
322322
mixins: [
323323
countlyVue.mixins.hasDrawers(["eventgroup"]),
324-
countlyVue.mixins.auth(FEATURE_NAME)
324+
countlyVue.mixins.auth(FEATURE_NAME),
325+
countlyVue.mixins.commonFormatters,
325326
],
326327
components: {
327328
'event-group-drawer': EventGroupDrawer,
@@ -386,7 +387,8 @@
386387
var EventsDefaultTabView = countlyVue.views.create({
387388
template: CV.T('/data-manager/templates/events-default.html'),
388389
mixins: [
389-
countlyVue.mixins.auth(FEATURE_NAME)
390+
countlyVue.mixins.auth(FEATURE_NAME),
391+
countlyVue.mixins.commonFormatters,
390392
],
391393
components: {
392394
'data-manager-manage-category': ManageCategory
@@ -783,7 +785,8 @@
783785
var EventsGroupsTabView = countlyVue.views.create({
784786
template: CV.T('/data-manager/templates/event-groups.html'),
785787
mixins: [
786-
countlyVue.mixins.auth(FEATURE_NAME)
788+
countlyVue.mixins.auth(FEATURE_NAME),
789+
countlyVue.mixins.commonFormatters,
787790
],
788791
data: function() {
789792
return {
@@ -1169,7 +1172,8 @@
11691172
countlyVue.container.mixins(["/manage/data-manager"]),
11701173
countlyVue.container.tabsMixin({
11711174
"externalTabs": "/manage/data-manager"
1172-
})
1175+
}),
1176+
countlyVue.mixins.commonFormatters,
11731177
],
11741178
data: function() {
11751179
var localTabs = [];
@@ -1198,7 +1202,8 @@
11981202
template: CV.T('/data-manager/templates/event-detail.html'),
11991203
mixins: [
12001204
countlyVue.mixins.hasDrawers(["events", "segments"]),
1201-
countlyVue.mixins.auth(FEATURE_NAME)
1205+
countlyVue.mixins.auth(FEATURE_NAME),
1206+
countlyVue.mixins.commonFormatters,
12021207
],
12031208
components: {
12041209
'events-drawer': EventsDrawer,

‎plugins/data-manager/frontend/public/templates/event-detail.html

+7-7
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
<cly-back-link link="/manage/data-manager/events/events" title="Back to Manage Events"></cly-back-link>
88
<div class="bu-mt-4">
99
<div class="bu-is-flex bu-is-align-items-center">
10-
<h3 class="bu-is-capitalized bu-mr-2">{{event.name || event.key}}</h3>
10+
<h3 class="bu-is-capitalized bu-mr-2">{{unescapeHtml(event.name || event.key)}}</h3>
1111
<cly-guide></cly-guide>
1212
</div>
1313
<div class="bu-mt-4 bu-mr-2">
@@ -65,22 +65,22 @@ <h3 class="bu-is-capitalized bu-mr-2">{{event.name || event.key}}</h3>
6565
<tr>
6666
<td><span>{{i18n('data-manager.events.key')}}</span>
6767
</td>
68-
<td v-html="event.key"></td>
68+
<td>{{unescapeHtml(event.key)}}</td>
6969
</tr>
7070
<tr>
7171
<td><span>{{i18n('data-manager.event-name')}}</span>
7272
</td>
73-
<td v-html="event.name"></td>
73+
<td>{{unescapeHtml(event.name)}}</td>
7474
</tr>
7575
<tr>
7676
<td><span>{{i18n('data-manager.description')}}</span>
7777
</td>
78-
<td v-html="event.description || '-' "></td>
78+
<td>{{unescapeHtml(event.description || '-')}}</td>
7979
</tr>
8080
<tr>
8181
<td><span>{{i18n('data-manager.category')}}</span>
8282
</td>
83-
<td v-html="categoriesMap[event.category] || i18n('data-manager.uncategorized')"></td>
83+
<td>{{unescapeHtml(categoriesMap[event.category] || i18n('data-manager.uncategorized'))}}</td>
8484
</tr>
8585
<tr>
8686
<td><span>{{i18n('data-manager.first-triggered')}}</span>
@@ -109,12 +109,12 @@ <h4>{{i18n('data-manager.event-segmentation')}}</h4>
109109
<template v-slot="scope">
110110
<el-table-column :label="i18n('data-manager.segment-name')" sortable="custom" prop="name">
111111
<template v-slot="rowScope">
112-
<div v-html="rowScope.row.name"></div>
112+
<div>{{unescapeHtml(rowScope.row.name)}}</div>
113113
</template>
114114
</el-table-column>
115115
<el-table-column :label="i18n('data-manager.description')">
116116
<template v-slot="rowScope">
117-
<div v-html="rowScope.row.description"></div>
117+
<div>{{unescapeHtml(rowScope.row.description)}}</div>
118118
</template>
119119
</el-table-column>
120120
<el-table-column :label="i18n('data-manager.status')" sortable="custom" prop="status">

‎plugins/data-manager/frontend/public/templates/event-group-detail.html

+4-4
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
<div>
77
<cly-back-link link="/manage/data-manager/events/event-groups" title="Back to Manage Event Groups"></cly-back-link>
88
<div class="bu-mt-4 bu-is-flex bu-is-align-items-center">
9-
<h3 class="bu-is-capitalized bu-mr-2" v-html="eventGroup.name"></h3>
9+
<h3 class="bu-is-capitalized bu-mr-2">{{unescapeHtml(eventGroup.name)}}</h3>
1010
<cly-guide></cly-guide>
1111
</div>
1212
<div class="bu-mt-4 bu-mr-2">
@@ -41,14 +41,14 @@ <h3 class="bu-is-capitalized bu-mr-2" v-html="eventGroup.name"></h3>
4141
<tr>
4242
<td><span>{{ i18n('data-manager.description') }}</span>
4343
</td>
44-
<td v-html="eventGroup.description"></td>
44+
<td>{{unescapeHtml(eventGroup.description)}}</td>
4545
</tr>
4646
<tr>
4747
<td>
4848
<span>{{ i18n('data-manager.included-events') }}</span>
4949
</td>
5050
<td>
51-
<div class="bu-mb-2" v-for="e in eventGroup.source_events"><div v-html="e"></div></div>
51+
<div class="bu-mb-2" v-for="e in eventGroup.source_events"><div>{{unescapeHtml(e)}}</div></div>
5252
</td>
5353
</tr>
5454
</tbody>
@@ -72,7 +72,7 @@ <h3 class="bu-is-capitalized bu-mr-2" v-html="eventGroup.name"></h3>
7272
{{ i18n('data-manager.delete-event-group-permanently') }}<br/>
7373
<small class="color-red-100"> {{i18n('data-manager.delete-event-warning')}} </small>
7474
<ul>
75-
<li v-if="deleteElement"><div v-html="deleteElement.name"></div></li>
75+
<li v-if="deleteElement"><div>{{unescapeHtml(deleteElement.name)}}</div></li>
7676
</ul>
7777
</template>
7878
</cly-confirm-dialog>

‎plugins/data-manager/frontend/public/templates/event-groups.html

+3-2
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,8 @@
2424

2525
<el-table-column fixed="left" sortable="custom" prop="name" :label="i18n('data-manager.event-group-name')" min-width="330px">
2626
<template v-slot="rowScope">
27-
<a v-bind:href="'#/manage/data-manager/events/event-groups/' + rowScope.row._id" @click="onRowClick(rowScope.row)" class="cly-vue-data-manager__clickable bu-is-clickable color-dark-blue-100" v-html="rowScope.row.name">
27+
<a v-bind:href="'#/manage/data-manager/events/event-groups/' + rowScope.row._id" @click="onRowClick(rowScope.row)" class="cly-vue-data-manager__clickable bu-is-clickable color-dark-blue-100">
28+
{{unescapeHtml(rowScope.row.name)}}
2829
</a>
2930
<div class="text-small color-cool-gray-50" v-if="rowScope.row.source_events">{{rowScope.row.source_events.length || 0}} Events</div>
3031
<span v-if="rowScope.row.status === false" class="cly-vue-data-manager__hidden-icon"><i class="ion-eye-disabled"></i></span>
@@ -34,7 +35,7 @@
3435

3536
<el-table-column sortable="custom" prop="description" :label="i18n('data-manager.event-group-description')" min-width="330px">
3637
<template v-slot="rowScope">
37-
<div v-html="rowScope.row.description || i18n('data-manager.empty-placeholder')"></div>
38+
<div>{{unescapeHtml(rowScope.row.description || i18n('data-manager.empty-placeholder'))}}</div>
3839
</template>
3940
</el-table-column>
4041

‎plugins/data-manager/frontend/public/templates/events-default.html

+4-4
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@
3939
<template v-slot="rowScope">
4040
<!-- <div @click="onRowClick(rowScope.row)" class="cly-vue-data-manager__clickable bu-is-clickable color-dark-blue-100">{{rowScope.row.name || rowScope.row.key || rowScope.row.e}}</div> -->
4141
<a v-bind:href="'#/manage/data-manager/events/events/' + rowScope.row.key" @click="onRowClick(rowScope.row)" class="cly-vue-data-manager__clickable bu-is-clickable color-dark-blue-100">
42-
<div v-html="rowScope.row.name || rowScope.row.key || rowScope.row.e"></div>
42+
<div>{{unescapeHtml(rowScope.row.name || rowScope.row.key || rowScope.row.e)}}</div>
4343
</a>
4444
<div v-if="rowScope.row.audit && rowScope.row.audit.userName" class="text-small color-cool-gray-50">Last modified by {{rowScope.row.audit.userName}}</div>
4545
<div>
@@ -75,7 +75,7 @@
7575
<el-table-column v-if="col.value === 'category'"
7676
min-width="250" sortable="custom" prop="categoryName" :label="i18n('data-manager.category')">
7777
<template v-slot="rowScope">
78-
<div v-html="rowScope.row.categoryName"></div>
78+
<div>{{unescapeHtml(rowScope.row.categoryName)}}</div>
7979
</template>
8080
</el-table-column>
8181

@@ -111,13 +111,13 @@
111111

112112
<el-table-column v-else-if="col.value === 'description' " sortable="custom" min-width="250" prop="description" :label="i18n('data-manager.description')">
113113
<template v-slot="rowScope">
114-
<div v-html="rowScope.row.description || i18n('data-manager.empty-placeholder')"></div>
114+
<div>{{unescapeHtml(rowScope.row.description || i18n('data-manager.empty-placeholder'))}}</div>
115115
</template>
116116
</el-table-column>
117117

118118
<el-table-column v-else v-bind:sortable="col.sort ? 'custom' : false" :key="idx" min-width="300" :prop="col.value" :label="col.label">
119119
<template v-slot="rowScope">
120-
<div v-html="rowScope.row[col.value] || i18n('data-manager.empty-placeholder')"></div>
120+
<div>{{unescapeHtml(rowScope.row[col.value] || i18n('data-manager.empty-placeholder'))}}</div>
121121
</template>
122122
</el-table-column>
123123
</template>

‎plugins/data-manager/frontend/public/templates/manage-category-components.html

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
<div class="cly-vue-data-manager__mci bg-white">
33
<div class="cly-vue-data-manager__mci--block bu-is-flex bu-is-justify-content-space-between bu-is-align-items-center bu-px-4"
44
v-if="!editing">
5-
<div class="text-medium" v-html="category.name"></div>
5+
<div class="text-medium">{{unescapeHtml(category.name)}}</div>
66
<div class="bu-is-flex">
77
<div @click="removeCategory" class="bu-mr-3"><i class="el-icon-delete color-cool-gray-50 bu-is-clickable"></i></div>
88
<div @click="editCategory"><i class="el-icon-edit color-cool-gray-50 bu-is-clickable"></i></div>

0 commit comments

Comments
 (0)