運営ユーザーが実行できないスクリプトイベントに「onerror」を追加、コンテンツ一覧でコンテンツを新規登録する際の通知メッセージをサニタイズ

plugins/baser-core/src/Model/Validation/BcValidation.php

@@ -475,7 +475,7 @@ public static function containsScript($value)
         if (!$value) return true;
         $events = ['onclick', 'ondblclick', 'onmousedown', 'onmouseup', 'onmouseover', 'onmousemove',
             'onmouseout', 'onkeypress', 'onkeydown', 'onkeyup', 'onload', 'onunload',
-            'onfocus', 'onblur', 'onsubmit', 'onreset', 'onselect', 'onchange'];
+            'onfocus', 'onblur', 'onsubmit', 'onreset', 'onselect', 'onchange', 'onerror'];
         if (BcUtil::isAdminUser() || Configure::read('BcApp.allowedPhpOtherThanAdmins')) {
             return true;
         }

plugins/bc-admin-third/src/js/admin/_lib/jquery.bcTree.js

@@ -1037,11 +1037,7 @@
                         data.name = result.content.name;
                         data.contentEntityId = result.content.entity_id;
                         data.contentTitle = result.content.title;
-                        data.contentTitle = data.contentTitle.replace(/&/g, '&')
-                            .replace(/"/g, '"')
-                            .replace(/'/g, ''')
-                            .replace(/</g, '&lt;')
-                            .replace(/>/g, '&gt;');
+
                         $.ajax($.bcUtil.apiAdminBaseUrl + 'baser-core/contents/get_full_url/' + data.contentId + '.json', {
                             type: 'GET',
                             dataType: 'json'
@@ -1103,9 +1099,7 @@
                             $.bcUtil.showLoader();
                         },
                         success: function (result) {
-                            if (!result) {
-                                $.bcUtil.showNoticeMessage(result.message);
-                            }
+                            $.bcUtil.showNoticeMessage(result.message);
                             $.bcTree.settings[node.data.jstree.contentType]['existsTitle'] = editNode.text;
                             editNode.data.jstree.contentFullUrl = result.url;
                             editNode.data.jstree.name = result.name;

plugins/bc-admin-third/src/js/admin/_lib/jquery.bcUtil.js

@@ -112,6 +112,11 @@ import Cookies from 'js-cookie'
          * @param message
          */
         showNoticeMessage: function (message) {
+            message = message.replace(/&/g, '&')
+                .replace(/"/g, '"')
+                .replace(/'/g, ''')
+                .replace(/</g, '&lt;')
+                .replace(/>/g, '&gt;');
             $.bcUtil.hideMessage();
             $("#BcSystemMessage")
                 .removeClass('notice-messge alert-message')