Fixed XSS vulnerabilities

craftcms · May 18, 2023 · 7655e10 · 7655e10
1 parent 45615ce
commit 7655e10
Show file tree

Hide file tree

Showing 5 changed files with 5 additions and 4 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -6,6 +6,7 @@
 - Fixed a bug where reverting an entry’s content from a revision could omit some Matrix blocks.
 - Fixed an error that could occur when adding a new site to an entry which contained Matrix blocks, if the same site had been added and removed previously.
 - Fixed a bug where Matrix blocks nested within Neo or Super Table fields could be omitted when propagating an entry to a new site. ([#13207](https://github.com/craftcms/cms/issues/13207))
+- Fixed two XSS vulnerabilities.
 
 ## 4.4.11 - 2023-05-15
 

diff --git a/src/web/assets/cp/dist/cp.js b/src/web/assets/cp/dist/cp.js
diff --git a/src/web/assets/cp/dist/cp.js.map b/src/web/assets/cp/dist/cp.js.map
diff --git a/src/web/assets/cp/src/js/BaseElementIndex.js b/src/web/assets/cp/src/js/BaseElementIndex.js
@@ -3457,7 +3457,7 @@ const ViewMenu = Garnish.Base.extend({
       .createSelect({
         options: this.elementIndex.getSortOptions(this.$source).map((o) => {
           return {
-            label: o.label,
+            label: Craft.escapeHtml(o.label),
             value: o.attr,
           };
         }),

diff --git a/src/web/assets/cp/src/js/CustomizeSourcesModal.js b/src/web/assets/cp/src/js/CustomizeSourcesModal.js
@@ -639,7 +639,7 @@ Craft.CustomizeSourcesModal.Source =
           name: `sources[${this.sourceData.key}][defaultSort][0]`,
           options: this.sourceData.sortOptions.map((o) => {
             return {
-              label: o.label,
+              label: Craft.escapeHtml(o.label),
               value: o.attr,
             };
           }),