Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

v1.5.5 #557

Merged
merged 31 commits into from Oct 29, 2017
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
31 commits
Select commit Hold shift + click to select a range
a3492c7
Update Mdl_custom_fields.php
patrice-guillemette Sep 19, 2017
fceb5de
Merge pull request #538 from patrice-guillemette/patch-1
Kovah Sep 19, 2017
f374f56
Assign all clients to a user account (IP-582)
daniel89fg Sep 20, 2017
279074f
Edit ip_lang
daniel89fg Sep 20, 2017
5c0e330
Merge pull request #539 from daniel89fg/1.5.5
Kovah Sep 20, 2017
b703f04
Fix translation errors
Sep 20, 2017
adbf108
Merge pull request #540 from Coelis/v1.5.5
Kovah Sep 21, 2017
3fc256c
Fixes escaping for client email / web address (IP-579)
Kovah Sep 25, 2017
ea36045
Merge pull request #542 from Kovah/1.5.5
Kovah Sep 25, 2017
dc71ffe
Version bump and readme update
Kovah Sep 25, 2017
032c3cf
Set proxy_ips from environment
j3k0 Oct 18, 2017
d3111fa
Make $custom_fields available in public templates
jmclaren7 Oct 23, 2017
5deec23
Merge pull request #547 from j3k0/master
Kovah Oct 26, 2017
4c92a31
Merge pull request #549 from jmclaren7/1.5.5
Kovah Oct 26, 2017
f7dcddc
Additional escaping regarding IP-579
Kovah Oct 26, 2017
7b64642
Merge pull request #551 from Kovah/1.5.5
Kovah Oct 26, 2017
5570221
Possible fix for IP-577
Kovah Oct 26, 2017
24d3c6a
Dependency update
Kovah Oct 26, 2017
c7b93a1
Preserve several item details while copying (IP-587)
Kovah Oct 26, 2017
2b618cf
Preserver payment method when copying invoices (IP-588)
Kovah Oct 26, 2017
8fd0fa2
Merge pull request #552 from Kovah/1.5.5
Kovah Oct 26, 2017
832da42
Several layout fixes for the Sumex implementation
Kovah Oct 26, 2017
4215ab2
Allow product search with enter (IP-590)
Kovah Oct 26, 2017
c5fc39f
Merge pull request #553 from Kovah/1.5.5
Kovah Oct 26, 2017
1179210
Set default item tax rate correctly (IP-589)
Kovah Oct 26, 2017
bcb3074
Fix and optimize the file housekeeping (IP-571)
Kovah Oct 26, 2017
bc151fe
Merge pull request #554 from Kovah/1.5.5
Kovah Oct 26, 2017
8611f32
Fix escaping for create quote/invoice modals (IP-606)
Kovah Oct 29, 2017
12426e7
Merge pull request #555 from Kovah/1.5.5
Kovah Oct 29, 2017
1d51888
Enable Select2 translation (IP-608)
Kovah Oct 29, 2017
50095f4
Merge pull request #556 from Kovah/1.5.5
Kovah Oct 29, 2017
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
Fixes escaping for client email / web address (IP-579)
  • Loading branch information
Kovah committed Sep 25, 2017
commit 3fc256ccef403f5be9982f02ef340d9e01daabb2
11 changes: 11 additions & 0 deletions application/helpers/echo_helper.php
Expand Up @@ -51,3 +51,14 @@ function _trans($line, $id = '', $default = null)
{
echo trans($line, $id, $default);
}

/**
* Echo for the auto link function with special chars handling
*
* @param $str
* @param string $type
* @param bool $popup
*/
function _auto_link($str, $type = 'both', $popup = FALSE) {
echo auto_link(htmlsc($str), $type, $popup);

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a fix for the Stored XSS issue that I found in the client email field. This is just provenance for the required identifier.

}
4 changes: 2 additions & 2 deletions application/modules/clients/views/view.php
Expand Up @@ -144,7 +144,7 @@ class="btn btn-default">
<?php if ($client->client_email) : ?>
<tr>
<th><?php _trans('email'); ?></th>
<td><?php echo auto_link($client->client_email, 'email'); ?></td>
<td><?php _auto_link($client->client_email, 'email'); ?></td>
</tr>
<?php endif; ?>
<?php if ($client->client_phone) : ?>
Expand All @@ -168,7 +168,7 @@ class="btn btn-default">
<?php if ($client->client_web) : ?>
<tr>
<th><?php _trans('web'); ?></th>
<td><?php echo auto_link($client->client_web, 'url', true); ?></td>
<td><?php _auto_link($client->client_web, 'url', true); ?></td>
</tr>
<?php endif; ?>

Expand Down