espocrm-extensions/espocrm-base
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

array field escaping

Browse Source
This commit is contained in:
yuri
2019-02-15 17:01:33 +02:00
parent 68dfa92425
commit 49fe1a75db
3 changed files with 21 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/src/views/fields/array.js
+15 -11
View File
@@ -338,11 +338,11 @@ Espo.define('views/fields/array', ['views/fields/base', 'lib!Selectize'], functi
var label = null;
if (this.translatedOptions != null) {
if (item in this.translatedOptions) {
label = this.getHelper().stripTags(this.translatedOptions[item]);
label = this.escapeValue(item);
}
}
if (label === null) {
label = this.getHelper().stripTags(item);
label = this.escapeValue(item);
}
if (label === '') {
label = this.translate('None');
@@ -379,17 +379,16 @@ Espo.define('views/fields/array', ['views/fields/base', 'lib!Selectize'], functi
value = value.toString();
var valueSanitized = this.getHelper().stripTags(value);
var valueSanitized = valueSanitized.replace(/"/g, '"');
var valueSanitized = this.escapeValue(value);
var label = valueSanitized;
if (this.translatedOptions) {
label = ((value in this.translatedOptions) ? this.translatedOptions[value] : label);
label = label.toString();
label = this.getHelper().stripTags(label);
label = label.replace(/"/g, '"');
if ((value in this.translatedOptions)) {
label = this.translatedOptions[value];
label = label.toString();
label = this.escapeValue(label);
}
}
var html = '<div class="list-group-item" data-value="' + valueSanitized + '" style="cursor: default;">' + label +
'&nbsp;<a href="javascript:" class="pull-right" data-value="' + valueSanitized + '" data-action="removeValue"><span class="fas fa-times"></a>' +
'</div>';
@@ -397,6 +396,10 @@ Espo.define('views/fields/array', ['views/fields/base', 'lib!Selectize'], functi
return html;
},
escapeValue: function (value) {
return Handlebars.Utils.escapeExpression(value);
},
addValue: function (value) {
if (this.selected.indexOf(value) == -1) {
var html = this.getItemHtml(value);
@@ -407,9 +410,10 @@ Espo.define('views/fields/array', ['views/fields/base', 'lib!Selectize'], functi
},
removeValue: function (value) {
var valueSanitized = this.getHelper().stripTags(value).replace(/"/g, '\\"');
var valueInternal = value.replace(/"/g, '\\"');
this.$list.children('[data-value="' + valueInternal + '"]').remove();
this.$list.children('[data-value="' + valueSanitized + '"]').remove();
var index = this.selected.indexOf(value);
this.selected.splice(index, 1);
this.trigger('change');