Skip to content

Commit 9a1cc48

Browse files
kanwarujjavalkanwarujjaval
authored
Merge pull request #4858 from Countly/Ratings-XSS
[SER-1082] XSS changes for ratings
2 parents a0907e4 + 9ead089 commit 9a1cc48

File tree

6 files changed

+14
-10
lines changed

6 files changed

+14
-10
lines changed

‎plugins/star-rating/frontend/public/javascripts/countly.views.js

+8-4
Original file line numberDiff line numberDiff line change
@@ -15,12 +15,12 @@
1515
}
1616

1717
var Drawer = countlyVue.views.create({
18+
mixins: [countlyVue.mixins.commonFormatters],
1819
template: CV.T("/star-rating/templates/drawer.html"),
1920
props: {
2021
settings: Object,
2122
controls: Object
2223
},
23-
mixins: [],
2424
data: function() {
2525
return {
2626
imageSource: '',
@@ -182,6 +182,7 @@
182182

183183
// these table components should be 3 different components
184184
var CommentsTable = countlyVue.views.create({
185+
mixins: [countlyVue.mixins.commonFormatters],
185186
template: CV.T("/star-rating/templates/comments-table.html"),
186187
props: {
187188
comments: Array,
@@ -284,7 +285,8 @@
284285
var WidgetsTable = countlyVue.views.create({
285286
template: CV.T("/star-rating/templates/widgets-table.html"),
286287
mixins: [
287-
countlyVue.mixins.auth(FEATURE_NAME)
288+
countlyVue.mixins.auth(FEATURE_NAME),
289+
countlyVue.mixins.commonFormatters
288290
],
289291
props: {
290292
rows: {
@@ -821,7 +823,8 @@
821823
},
822824
mixins: [
823825
countlyVue.mixins.hasDrawers("widget"),
824-
countlyVue.mixins.auth(FEATURE_NAME)
826+
countlyVue.mixins.auth(FEATURE_NAME),
827+
countlyVue.mixins.commonFormatters
825828
],
826829
data: function() {
827830
return {
@@ -1083,7 +1086,7 @@
10831086
starRatingPlugin.requestSingleWidget(this.$route.params.id, function(widget) {
10841087
self.widget = widget;
10851088
self.widget.popup_header_text = replaceEscapes(self.widget.popup_header_text);
1086-
self.widget.created_at = countlyCommon.formatTimeAgo(self.widget.created_at);
1089+
self.widget.created_at = countlyCommon.formatTimeAgoText(self.widget.created_at).text;
10871090
if (self.cohortsEnabled) {
10881091
self.widget = self.parseTargeting(widget);
10891092
}
@@ -1177,6 +1180,7 @@
11771180
});
11781181

11791182
var UserFeedbackRatingsTable = countlyVue.views.create({
1183+
mixins: [countlyVue.mixins.commonFormatters],
11801184
template: CV.T('/star-rating/templates/users-feedback-ratings-table.html'),
11811185
props: {
11821186
ratings: {

‎plugins/star-rating/frontend/public/templates/comments-table.html

+1-1
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
</el-table-column>
1919
<el-table-column sortable="true" prop="cd" :label="i18n('feedback.time')" min-width="120">
2020
<template v-slot="rowScope">
21-
<span class="text-medium" :data-test-id="'ratings-comment-table-time-row-' + rowScope.$index" v-html="rowScope.row.cd"></span>
21+
<span class="text-medium" :data-test-id="'ratings-comment-table-time-row-' + rowScope.$index">{{unescapeHtml(rowScope.row.cd)}}</span>
2222
</template>
2323
</el-table-column>
2424
<el-table-column prop="email" :label="i18n('feedback.email')" min-width="200">

‎plugins/star-rating/frontend/public/templates/drawer.html

+1-1
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222
</div>
2323
<div class="ratings-drawer__ratings-popup">
2424
<div class="ratings-drawer__rp-question-area" data-test-id="ratings-drawer-ratingspopup-question">
25-
{{ drawerScope.editedObject.popup_header_text }}
25+
{{ unescapeHtml(drawerScope.editedObject.popup_header_text) }}
2626
</div>
2727
<div v-if="drawerScope.editedObject.ratings_texts">
2828
<div class="ratings-drawer__rp-ratings-area" v-if="drawerScope.editedObject.rating_symbol==='emojis'">

‎plugins/star-rating/frontend/public/templates/users-feedback-ratings-table.html

+1-1
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
</el-table-column>
1717
<el-table-column prop="time" column-key="ts" :label="i18n('feedback.time')">
1818
<template v-slot="rowScope">
19-
<span v-html="rowScope.row.ts" class="text-medium"></span>
19+
<span class="text-medium">{{unescapeHtml(rowScope.row.ts)}}</span>
2020
</template>
2121
</el-table-column>
2222
</cly-datatable-n>

‎plugins/star-rating/frontend/public/templates/widget-detail.html

+2-2
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
<span data-test-id="ratings-detail-back-link-label">{{ i18n('feedback.back-to-rating-widgets') }}</span>
88
</div>
99
<div class="ratings-widget-detail-view__widget-name">
10-
<h3 v-html="widget.popup_header_text" class="ratings-widget-detail-view__widget-name" data-test-id="ratings-detail-widget-name-label"></h3>
10+
<h3 class="ratings-widget-detail-view__widget-name" data-test-id="ratings-detail-widget-name-label">{{unescapeHtml(widget.popup_header_text)}}</h3>
1111
</div>
1212
<div class="ratings-widget-detail-view__widget-informations bu-mt-4">
1313
<div :class="[widget.status && 'ratings-widget-detail-view__widget-status-active', !widget.status && 'ratings-widget-detail-view__widget-status-disabled', 'bu-has-text-weight-semibold text-small bu-mt-1']">
@@ -16,7 +16,7 @@ <h3 v-html="widget.popup_header_text" class="ratings-widget-detail-view__widget-
1616
</div>
1717
<div class="ratings-widget-detail-view__created-at text-medium bu-p-1 bu-ml-2"> <i class="ion-android-time" data-test-id="ratings-detail-created-at-icon"></i>
1818
<span data-test-id="ratings-detail-created-at-label">{{ i18n('feedback.created-at') }}</span>
19-
<span data-test-id="ratings-detail-created-at-value" v-html="widget.created_at"></span></div>
19+
<span data-test-id="ratings-detail-created-at-value">{{unescapeHtml(widget.created_at)}}</span></div>
2020
<div class="ratings-widget-detail-view__widget-id text-medium bu-p-1 bu-ml-2">
2121
<i data-test-id="ratings-detail-price-tag-icon" class="ion-pricetag"></i>
2222
<span data-test-id="ratings-detail-widget-id-label" class="ratings-widget-detail-view__widget-id">{{ i18n('feedback.widget-id') }} </span>

‎plugins/star-rating/frontend/public/templates/widgets-table.html

+1-1
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222
<template v-slot="rowScope">
2323
<div>
2424
<div @click="goWidgetDetail(rowScope.row._id)" :data-test-id="'ratings-widgets-data-table-widget-name-' + rowScope.$index" :class="[rowScope.row.hover && 'bu-is-underlined bu-is-clickable color-primary', 'color-dark-blue-100 text-medium']">
25-
{{rowScope.row.popup_header_text}}
25+
{{unescapeHtml(rowScope.row.popup_header_text)}}
2626
</div>
2727
<div>
2828
<span :data-test-id="'ratings-widgets-data-table-widget-id-label-' + rowScope.$index" class="color-cool-gray-40 text-small bu-has-text-weight-semibold"> {{ i18n('feedback.widget-id') }} </span>

0 commit comments

Comments
 (0)