Skip to content
This repository has been archived by the owner on Dec 19, 2023. It is now read-only.

Site wide stored cross site scripting via Client Side Template Injection #10

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Site wide stored cross site scripting via Client Side Template Injection #10

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8ab884e
sanitised csti
bolshoytoster May 7, 2021
b6941ce
sanitised csti
bolshoytoster May 7, 2021
058b0e5
sanitised csti
bolshoytoster May 7, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 18 additions & 18 deletions resources/views/people/_header.blade.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

@if ($contact->isMe())
<div class="alert alert-success tc">
{{ trans('people.me') }}
{{ preg_replace('/{{|}}/','',trans('people.me')) }}
</div>
@endif

Expand All @@ -20,13 +20,13 @@
<div class="hidden br3 dib white tc f1"
style="padding-top: 21px; height: 115px; width: 115px; background-color: {{ $contact->default_avatar_color }}"
>
{{ $contact->initials }}
{{ preg_replace('/{{|}}/','',$contact->initials) }}
</div>
</div>
<div class="child absolute top-0 left-0 h-100 w-100 br3">
<div class="db w-100 h-100 center tc pt5">
<a class="no-underline white" href="{{ route('people.avatar.edit', $contact) }}">
📷 {{ trans('app.update' )}}
📷 {{ preg_replace('/{{|}}/','',trans('app.update'))}}
</a>
</div>
</div>
Expand All @@ -37,12 +37,12 @@
<div class="mw9 center dt w-100 box-shadow pa4 relative">

<h1 class="tc mb2 mt4">
<span class="{{ htmldir() == 'ltr' ? 'mr1' : 'ml1' }}">{{ $contact->name }}</span>
<span class="{{ htmldir() == 'ltr' ? 'mr1' : 'ml1' }}">{{ preg_replace('/{{|}}/','',$contact->name) }}</span>
<contact-favorite hash="{{ $contact->hashID() }}" :starred="{{ \Safe\json_encode($contact->is_starred) }}"></contact-favorite>
@if ($contact->job)
<span class="db f5 normal">{{ $contact->job }}
<span class="db f5 normal">{{ preg_replace('/{{|}}/','',$contact->job) }}
@if ($contact->company)
({{ $contact->company }})
({{ preg_replace('/{{|}}/','',$contact->company) }})
@endif
</span>
@endif
Expand All @@ -56,21 +56,21 @@
@if ($contact->getBirthdayState() !== 'unknown')
<span class="{{ htmldir() == 'ltr' ? 'mr1' : 'ml1' }}">@include('partials.icons.header_birthday')</span>
@if($contact->getBirthdayState() === 'approximate')
<span>{{ trans('people.age_approximate_in_years', ['age' => $contact->birthdate->getAge()]) }}</span>
<span>{{ preg_replace('/{{|}}/','',trans('people.age_approximate_in_years', ['age' => $contact->birthdate->getAge()])) }}</span>
@elseif($contact->getBirthdayState() === 'almost')
<span>{{$contact->birthdate->toShortString()}}</span>
<span>{{preg_replace('/{{|}}/',''$contact->birthdate->toShortString())}}</span>
@else
<span>{{$contact->birthdate->toShortString()}} ({{ $contact->birthdate->getAge() }})</span>
<span>{{preg_replace('/{{|}}/','',$contact->birthdate->toShortString())}} ({{ preg_replace('/{{|}}/','',$contact->birthdate->getAge()) }})</span>
@endif
@endif
@elseif ($contact->is_dead)
@if (! is_null($contact->deceasedDate))
{{ trans('people.deceased_label_with_date', ['date' => $contact->deceasedDate->toShortString()]) }}
{{ preg_replace('/{{|}}/','',trans('people.deceased_label_with_date', ['date' => $contact->deceasedDate->toShortString()])) }}
@if ($contact->deceasedDate->is_year_unknown == 0 && $contact->getBirthdayState() !== 'almost')
<span>({{ trans('people.deceased_age') }} {{ $contact->getAgeAtDeath() }})</span>
<span>({{ preg_replace('/{{|}}/','',trans('people.deceased_age')) }} {{ preg_replace('/{{|}}/','',$contact->getAgeAtDeath()) }})</span>
@endif
@else
{{ trans('people.deceased_label') }}
{{ preg_replace('/{{|}}/','',trans('people.deceased_label')) }}
@endif
@endif
</li>
Expand All @@ -80,9 +80,9 @@
<li class="mb2 mb0-ns dn di-ns tc {{ htmldir() == 'ltr' ? 'mr3-ns' : 'ml3-ns' }}">
<span class="{{ htmldir() == 'ltr' ? 'mr1' : 'ml1' }}">@include('partials.icons.header_people')</span>
@if (is_null($contact->getLastActivityDate()))
{{ trans('people.last_activity_date_empty') }}
{{ preg_replace('/{{|}}/','',trans('people.last_activity_date_empty')) }}
@else
{{ trans('people.last_activity_date', ['date' => \App\Helpers\DateHelper::getShortDate($contact->getLastActivityDate())]) }}
{{ preg_replace('/{{|}}/','',trans('people.last_activity_date', ['date' => \App\Helpers\DateHelper::getShortDate($contact->getLastActivityDate())])) }}
@endif
</li>
@endif
Expand All @@ -92,9 +92,9 @@
<li class="mb2 mb0-ns dn di-ns tc {{ htmldir() == 'ltr' ? 'mr3-ns' : 'ml3-ns' }}">
<span class="{{ htmldir() == 'ltr' ? 'mr1' : 'ml1' }}">@include('partials.icons.header_call')</span>
@if (is_null($contact->last_talked_to))
{{ trans('people.last_called_empty') }}
{{ preg_replace('/{{|}}/','',trans('people.last_called_empty')) }}
@else
{{ trans('people.last_called', ['date' => \App\Helpers\DateHelper::getShortDate($contact->last_talked_to)]) }}
{{ preg_replace('/{{|}}/','',trans('people.last_called', ['date' => \App\Helpers\DateHelper::getShortDate($contact->last_talked_to)])) }}
@endif
</li>
@endif
Expand All @@ -103,7 +103,7 @@
@if ($contact->description)
<li class="mb2 mb0-ns di-ns db tc {{ htmldir() == 'ltr' ? 'mr3-ns' : 'ml3-ns' }}">
@include('partials.icons.header_description')
{{ $contact->description }}
{{ preg_replace('/{{|}}/','',$contact->description) }}
</li>
@endif

Expand All @@ -119,7 +119,7 @@
<tags hash="{{ $contact->hashID() }}" class="mb3 mb0-ns"></tags>

<div class="absolute-ns tc profile-edit-contact-button">
<a href="{{ route('people.edit', $contact) }}" class="btn" id="button-edit-contact">{{ trans('people.edit_contact_information') }}</a>
<a href="{{ route('people.edit', $contact) }}" class="btn" id="button-edit-contact">{{ preg_replace('/{{|}}/','',trans('people.edit_contact_information')) }}</a>
</div>
</div>
</div>
Expand Down