webui: quote strings with slashes in job index and details view

Strings comming from "translate" function can contain apostrophes that need to be escaped.
bareos · Jul 15, 2021 · d72df73 · d72df73
1 parent f43a1a3
commit d72df73
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 8 deletions.
diff --git a/webui/module/Job/view/job/job/details.phtml b/webui/module/Job/view/job/job/details.phtml
@@ -148,23 +148,23 @@ $this->headTitle($title);
       html.push('<div class="container-fluid">');
       html.push('<table class="table table-bordered">');
       html.push('<tr>');
-      html.push('<th><?php echo $this->translate("Fileset"); ?></th>');
+      html.push('<th><?php echo addslashes($this->translate("Fileset")); ?></th>');
       html.push('<td><a href="<?php echo $this->basePath() . '/fileset/details/'; ?>' + row.filesetid + '">' + row.fileset +'</a></td>');
       html.push('</tr>');
       html.push('<tr>');
-      html.push('<th><?php echo $this->translate("Pool"); ?></th>');
+      html.push('<th><?php echo addslashes($this->translate("Pool")); ?></th>');
       html.push('<td><a href="<?php echo $this->basePath() . '/pool/details/'; ?>' + row.poolname + '">' + row.poolname + '</a></td>');
       html.push('</tr>');
       html.push('<tr>');
-      html.push('<th><?php echo $this->translate("Scheduled"); ?></th>');
+      html.push('<th><?php echo addslashes($this->translate("Scheduled")); ?></th>');
       html.push('<td>' + row.schedtime + '</td>');
       html.push('</tr>');
       html.push('<tr>');
-      html.push('<th><?php echo $this->translate("Start"); ?></th>');
+      html.push('<th><?php echo addslashes($this->translate("Start")); ?></th>');
       html.push('<td>' + row.starttime + '</td>');
       html.push('</tr>');
       html.push('<tr>');
-      html.push('<th><?php echo $this->translate("End"); ?></th>');
+      html.push('<th><?php echo addslashes($this->translate("End")); ?></th>');
       html.push('<td>' + row.endtime + '</td>');
       html.push('</tr>');
       html.push('</table>');

diff --git a/webui/module/Job/view/job/job/index.phtml b/webui/module/Job/view/job/job/index.phtml
@@ -296,15 +296,15 @@ $this->headTitle($title);
       html.push('<div class="container-fluid">');
       html.push('<table class="table table-bordered">');
       html.push('<tr>');
-      html.push('<th><?php echo $this->translate("Fileset"); ?></th>');
+      html.push('<th><?php echo addslashes($this->translate("Fileset")); ?></th>');
       html.push('<td><a href="<?php echo $this->basePath() . '/fileset/details/'; ?>' + row.filesetid + '">' + row.fileset +'</a></td>');
       html.push('</tr>');
       html.push('<tr>');
-      html.push('<th><?php echo $this->translate("Pool"); ?></th>');
+      html.push('<th><?php echo addslashes($this->translate("Pool")); ?></th>');
       html.push('<td><a href="<?php echo $this->basePath() . '/pool/details/'; ?>' + row.poolname + '">' + row.poolname + '</a></td>');
       html.push('</tr>');
       html.push('<tr>');
-      html.push('<th><?php echo $this->translate("Scheduled"); ?></th>');
+      html.push('<th><?php echo addslashes($this->translate("Scheduled")); ?></th>');
       html.push('<td>' + row.schedtime + '</td>');
       html.push('</tr>');
       html.push('</table>');