Merge branch 'main' into issue-OWASP-BLT#1517

JisanAR03 · Oct 31, 2023 · fea6414 · fea6414
2 parents daf10cb + f27ce8f
commit fea6414
Show file tree

Hide file tree

Showing 10 changed files with 124 additions and 146 deletions.
diff --git a/poetry.lock b/poetry.lock
diff --git a/pyproject.toml b/pyproject.toml
@@ -53,7 +53,7 @@ django-tz-detect = "^0.4.0"
 django-tellme = "^0.7.3"
 django-bootstrap-datepicker-plus = "^5.0.4"
 django-star-ratings = "^0.9.2"
-stripe = "^7.0.0"
+stripe = "^7.1.0"
 django-environ = "^0.11.2"
 django-humanize = "^0.1.2"
 drf-yasg = "^1.20.0"

diff --git a/website/static/css/style-dashboard.css b/website/static/css/style-dashboard.css
@@ -5846,7 +5846,7 @@ p.date-in, span.date-on{
 .tile-progress {
   padding: 15px;
 }
-i.fa.fa-facebook, i.fa.fa-twitter, i.fa.fa-google-plus, i.fa.fa-dribbble, i.fa.fa-linkedin, i.fa.fa-youtube, i.fa.fa-skype, i.fa.fa-flickr{
+i.fa.fa-facebook, i.fa.fa-x-twitter, i.fa.fa-google-plus, i.fa.fa-dribbble, i.fa.fa-linkedin, i.fa.fa-youtube, i.fa.fa-skype, i.fa.fa-flickr{
   font-size: 30px;
 }
 h3.count.text-light {

diff --git a/website/static/js/jquery.atwho.js b/website/static/js/jquery.atwho.js
@@ -786,7 +786,7 @@
                 }
             }
             if ($query.length > 0 && (query_content = $query.attr('data-atwho-at-query'))) {
-                $query.empty().html(query_content).attr('data-atwho-at-query', null);
+                $query.empty().text(query_content).removeAttr('data-atwho-at-query');
                 this._setRange('after', $query.get(0), range);
             }
             _range = range.cloneRange();

diff --git a/website/static/vendor/bootstrap/js/bootstrap.js b/website/static/vendor/bootstrap/js/bootstrap.js
@@ -520,7 +520,14 @@ function sanitizeSelector(selector) {
     var clickHandler = function (e) {
         var href
         var $this = $(this)
-        var $target = $($this.attr('data-target') || (href = $this.attr('href')) && href.replace(/.*(?=#[^\s]+$)/, '')) // strip for ie7
+
+        // sanitizing the elements
+        var dataTarget = $this.attr('data-target');
+        var href = $this.attr('href');
+        var sanitizedDataTarget = escapeHTML(dataTarget);
+        var sanitizedHref = escapeHTML(href);
+        var $target = $(sanitizedDataTarget || sanitizedHref && sanitizedHref.replace(/.*(?=#[^\s]+$)/, ''));
+
         if (!$target.hasClass('carousel')) return
         var options = $.extend({}, $target.data(), $this.data())
         var slideIndex = $this.attr('data-slide-to')

diff --git a/website/templates/contributors_detail.html b/website/templates/contributors_detail.html
@@ -33,7 +33,7 @@
                 >
                 <a href="{{contributor.twitter}}" target="_blank" rel="noopener noreferrer">
                     <i
-                    class="scale-150 m-3 fa-brands fa-twitter fa-lg cursor-pointer transition duration-100 hover:text-red-500"
+                    class="scale-150 m-3 fa-brands fa-x-twitter fa-lg cursor-pointer transition duration-100 hover:text-red-500"
                     ></i>
                 </a>
                 <a href="{{contributor.linkedin}}" target="_blank" rel="noopener noreferrer">
@@ -53,4 +53,4 @@
       </div>
     </div>
   </section>
-{% endblock %}
+{% endblock %}