espocrm-extensions/espocrm-base
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

array field escaping

Browse Source
This commit is contained in:
yuri
2019-02-15 17:01:33 +02:00
parent 68dfa92425
commit 49fe1a75db
3 changed files with 21 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/src/views/admin/field-manager/fields/options-with-style.js
+3 -2
View File
@@ -49,6 +49,7 @@ Espo.define('views/admin/field-manager/fields/options-with-style', 'views/admin/
changeStyle: function (value, style) {
var valueInternal = value.replace(/"/g, '\\"');
this.$el.find('[data-action="selectOptionItemStyle"][data-value="'+valueInternal+'"] .check-icon').addClass('hidden');
this.$el.find('[data-action="selectOptionItemStyle"][data-value="'+valueInternal+'"][data-style="'+style+'"] .check-icon').removeClass('hidden');
@@ -71,8 +72,8 @@ Espo.define('views/admin/field-manager/fields/options-with-style', 'views/admin/
if (!value) return html;
var valueSanitized = this.getHelper().stripTags(value);
var valueInternal = valueSanitized.replace(/"/g, '"');
var valueSanitized = this.escapeValue(value);
var valueInternal = this.escapeValue(value);
var $item = $(html);
client/src/views/admin/field-manager/fields/options.js
+3 -2
View File
@@ -45,12 +45,13 @@ Espo.define('views/admin/field-manager/fields/options', 'views/fields/array', fu
},
getItemHtml: function (value) {
var valueSanitized = this.getHelper().stripTags(value);
var valueSanitized = this.escapeValue(value);
var translatedValue = this.translatedOptions[value] || valueSanitized;
translatedValue = translatedValue.replace(/"/g, '"');
var valueInternal = valueSanitized.replace(/"/g, '"');
var valueInternal = this.escapeValue(value);
var html = '' +
'<div class="list-group-item link-with-role form-inline" data-value="' + valueInternal + '">' +
client/src/views/fields/array.js
+15 -11
View File
@@ -338,11 +338,11 @@ Espo.define('views/fields/array', ['views/fields/base', 'lib!Selectize'], functi
var label = null;
if (this.translatedOptions != null) {
if (item in this.translatedOptions) {
label = this.getHelper().stripTags(this.translatedOptions[item]);
label = this.escapeValue(item);
}
}
if (label === null) {
label = this.getHelper().stripTags(item);
label = this.escapeValue(item);
}
if (label === '') {
label = this.translate('None');
@@ -379,17 +379,16 @@ Espo.define('views/fields/array', ['views/fields/base', 'lib!Selectize'], functi
value = value.toString();
var valueSanitized = this.getHelper().stripTags(value);
var valueSanitized = valueSanitized.replace(/"/g, '&quot;');
var valueSanitized = this.escapeValue(value);
var label = valueSanitized;
if (this.translatedOptions) {
label = ((value in this.translatedOptions) ? this.translatedOptions[value] : label);
label = label.toString();
label = this.getHelper().stripTags(label);
label = label.replace(/"/g, '&quot;');
if ((value in this.translatedOptions)) {
label = this.translatedOptions[value];
label = label.toString();
label = this.escapeValue(label);
}
}
var html = '<div class="list-group-item" data-value="' + valueSanitized + '" style="cursor: default;">' + label +
'&nbsp;<a href="javascript:" class="pull-right" data-value="' + valueSanitized + '" data-action="removeValue"><span class="fas fa-times"></a>' +
'</div>';
@@ -397,6 +396,10 @@ Espo.define('views/fields/array', ['views/fields/base', 'lib!Selectize'], functi
return html;
},
escapeValue: function (value) {
return Handlebars.Utils.escapeExpression(value);
},
addValue: function (value) {
if (this.selected.indexOf(value) == -1) {
var html = this.getItemHtml(value);
@@ -407,9 +410,10 @@ Espo.define('views/fields/array', ['views/fields/base', 'lib!Selectize'], functi
},
removeValue: function (value) {
var valueSanitized = this.getHelper().stripTags(value).replace(/"/g, '\\"');
var valueInternal = value.replace(/"/g, '\\"');
this.$list.children('[data-value="' + valueInternal + '"]').remove();
this.$list.children('[data-value="' + valueSanitized + '"]').remove();
var index = this.selected.indexOf(value);
this.selected.splice(index, 1);
this.trigger('change');