From: CiviCRM Date: Sat, 2 Sep 2023 05:13:40 +0000 (-0700) Subject: CIVI-SA-2023-11 - Potential XSS X-Git-Url: https://vcs.fsf.org/?a=commitdiff_plain;h=10dbd8f0091c5f2356f15b7b9c981f2436658f15;p=civicrm-core.git CIVI-SA-2023-11 - Potential XSS --- diff --git a/js/Common.js b/js/Common.js index 5521a863e7..f1bb534944 100644 --- a/js/Common.js +++ b/js/Common.js @@ -544,8 +544,8 @@ if (!CRM.vars) CRM.vars = {}; } var markup = ''; @@ -604,7 +604,7 @@ if (!CRM.vars) CRM.vars = {}; } }, formatInputTooShort: function() { - var txt = $.fn.select2.defaults.formatInputTooShort.call(this); + var txt = _.escape($.fn.select2.defaults.formatInputTooShort.call(this)); txt += getStaticOptionMarkup(staticItems); return txt; } @@ -745,12 +745,12 @@ if (!CRM.vars) CRM.vars = {}; } else { selectParams.formatInputTooShort = function() { - var txt = $el.data('select-params').formatInputTooShort || $.fn.select2.defaults.formatInputTooShort.call(this); + var txt = _.escape($el.data('select-params').formatInputTooShort || $.fn.select2.defaults.formatInputTooShort.call(this)); txt += entityRefFiltersMarkup($el) + renderEntityRefCreateLinks($el); return txt; }; selectParams.formatNoMatches = function() { - var txt = $el.data('select-params').formatNoMatches || $.fn.select2.defaults.formatNoMatches; + var txt = _.escape($el.data('select-params').formatNoMatches || $.fn.select2.defaults.formatNoMatches); txt += entityRefFiltersMarkup($el) + renderEntityRefCreateLinks($el); return txt; }; @@ -844,14 +844,14 @@ if (!CRM.vars) CRM.vars = {}; CRM.utils.formatSelect2Result = function (row) { var markup = '
'; if (row.image !== undefined) { - markup += '
'; + markup += '
'; } else if (row.icon_class) { - markup += '
'; + markup += '
'; } - markup += '
' + - (row.color ? ' ' : '') + - (row.icon ? ' ' : '') + + markup += '
' + + (row.color ? ' ' : '') + + (row.icon ? ' ' : '') + _.escape((row.prefix !== undefined ? row.prefix + ' ' : '') + row.label + (row.suffix !== undefined ? ' ' + row.suffix : '')) + '
' + '
'; @@ -863,7 +863,7 @@ if (!CRM.vars) CRM.vars = {}; }; function formatEntityRefSelection(row) { - return (row.color ? ' ' : '') + + return (row.color ? ' ' : '') + _.escape((row.prefix !== undefined ? row.prefix + ' ' : '') + row.label + (row.suffix !== undefined ? ' ' + row.suffix : '')); } @@ -893,8 +893,8 @@ if (!CRM.vars) CRM.vars = {}; } } _.each(createLinks, function(link) { - markup += ' ' + - ' ' + + markup += ' ' + + ' ' + _.escape(link.label) + ''; }); markup += '
';