Skip to content

Commit 97cd7cf

Browse files
authored
Merge pull request #4838 from pnrgenc/SER-1081
[SER-1081] Stored XSS on dashboard name
2 parents bb5505b + 2be7ebe commit 97cd7cf

File tree

5 files changed

+5
-5
lines changed

5 files changed

+5
-5
lines changed

plugins/dashboards/frontend/public/javascripts/countly.views.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -1644,7 +1644,7 @@
16441644

16451645
var DashboardsMenu = countlyVue.views.create({
16461646
template: CV.T('/dashboards/templates/dashboards-menu.html'),
1647-
mixins: [countlyVue.mixins.hasDrawers("dashboards"), DashboardMixin],
1647+
mixins: [countlyVue.mixins.hasDrawers("dashboards"), DashboardMixin, countlyVue.mixins.commonFormatters],
16481648
components: {
16491649
"dashboards-drawer": DashboardDrawer
16501650
},

plugins/dashboards/frontend/public/templates/dashboards-menu.html

+1-1
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
:class="['cly-vue-sidebar__menu-items has-ellipsis',
2828
{'cly-vue-sidebar__menu-items--selected': selectedDashboard._id === dashboard._id}]"
2929
@click="onDashboardMenuItemClick(dashboard)">
30-
<span v-html="dashboard.name"></span>
30+
<span>{{unescapeHtml(dashboard.name)}}</span>
3131
</div>
3232
</a>
3333
</li>

plugins/dashboards/frontend/public/templates/helpers/widget/primary-legend.html

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<div class="bu-is-flex bu-is-align-items-center bu-my-2">
22
<div class="clyd-legend-app bu-is-flex-shrink-1" v-if="customText" style="min-width: 0;">
33
<div class="bu-is-flex">
4-
<span class="bu-ml-1 text-small has-ellipsis bu-is-flex-shrink-1" v-html="customText"></span>
4+
<span class="bu-ml-1 text-small has-ellipsis bu-is-flex-shrink-1">{{unescapeHtml(customText)}}</span>
55
</div>
66
</div>
77

plugins/dashboards/frontend/public/templates/helpers/widget/secondary-legend.html

+1-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
<div v-if="item.labels && item.labels.length" class="bu-is-flex bu-is-align-items-center bu-is-flex-shrink-1 bu-is-flex-grow-1" style="min-width: 0">
55
<div v-for="(label, i) in item.labels" :class="['bu-is-flex bu-is-align-items-center bu-is-flex-shrink-1 bu-px-2 bu-mr-1']" :style="{backgroundColor: label.color + '26', borderRadius: '4px', minWidth: 0}">
66
<i class="fas fa-circle bu-mr-2" :style="{fontSize: '6px', color: label.color}"></i>
7-
<span class="text-small has-ellipsis bu-is-flex-shrink-1" v-html="label.label"></span>
7+
<span class="text-small has-ellipsis bu-is-flex-shrink-1">{{unescapeHtml(label.label)}}</span>
88
</div>
99
</div>
1010
</div>
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
<div class="bu-is-flex bu-is-flex-shrink-1" style="min-width: 0">
2-
<h4 class="bu-is-flex-shrink-1 has-ellipsis" v-if="title" v-html="title"></h4>
2+
<h4 class="bu-is-flex-shrink-1 has-ellipsis" v-if="title">{{unescapeHtml(title)}}</h4>
33
<clyd-title-labels v-if="labels && labels.length" :labels="labels"></clyd-title-labels>
44
</div>

0 commit comments

Comments
 (0)