Skip to content

Commit

Permalink
fix(login): Escape translated strings (#24431)
Browse files Browse the repository at this point in the history 
* Use `tojson` instead of `json` Jinja filter
  • Loading branch information
@cogk
cogk committed Feb 2, 2024
1 parent 380b33d commit 11baf6e
Showing 1 changed file with 32 additions and 30 deletions.
62 changes: 32 additions & 30 deletions frappe/templates/includes/login/login.js
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,8 @@ login.bind_events = function () {
args.usr = frappe.utils.xss_sanitise(($("#login_email").val() || "").trim());
args.pwd = $("#login_password").val();
if (!args.usr || !args.pwd) {
frappe.msgprint('{{ _("Both login and password required") }}');
{# striptags is used to remove newlines, e is used for escaping #}
frappe.msgprint("{{ _('Both login and password required') | striptags | e }}");
return false;
}
login.call(args, null, "/login");
Expand All @@ -36,7 +37,7 @@ login.bind_events = function () {
args.redirect_to = frappe.utils.sanitise_redirect(frappe.utils.get_url_arg("redirect-to"));
args.full_name = frappe.utils.xss_sanitise(($("#signup_fullname").val() || "").trim());
if (!args.email || !validate_email(args.email) || !args.full_name) {
login.set_status('{{ _("Valid email and name required") }}', 'red');
login.set_status({{ _("Valid email and name required") | tojson }}, 'red');
return false;
}
login.call(args);
Expand All @@ -49,7 +50,7 @@ login.bind_events = function () {
args.cmd = "frappe.core.doctype.user.user.reset_password";
args.user = ($("#forgot_email").val() || "").trim();
if (!args.user) {
login.set_status('{{ _("Valid Login id required.") }}', 'red');
login.set_status({{ _("Valid Login id required.") | tojson }}, 'red');
return false;
}
login.call(args);
Expand All @@ -62,14 +63,14 @@ login.bind_events = function () {
args.cmd = "frappe.www.login.send_login_link";
args.email = ($("#login_with_email_link_email").val() || "").trim();
if (!args.email) {
login.set_status('{{ _("Valid Login id required.") }}', 'red');
login.set_status({{ _("Valid Login id required.") | tojson }}, 'red');
return false;
}
login.call(args).then(() => {
login.set_status('{{ _("Login link sent to your email") }}', 'blue');
login.set_status({{ _("Login link sent to your email") | tojson }}, 'blue');
$("#login_with_email_link_email").val("");
}).catch(() => {
login.set_status('{{ _("Send login link") }}', 'blue');
login.set_status({{ _("Send login link") | tojson }}, 'blue');
});

return false;
Expand All @@ -79,10 +80,10 @@ login.bind_events = function () {
var input = $($(this).attr("toggle"));
if (input.attr("type") == "password") {
input.attr("type", "text");
$(this).text('{{ _("Hide") }}')
$(this).text({{ _("Hide") | tojson }})
} else {
input.attr("type", "password");
$(this).text('{{ _("Show") }}')
$(this).text({{ _("Show") | tojson }})
}
});

Expand All @@ -93,7 +94,7 @@ login.bind_events = function () {
args.usr = ($("#login_email").val() || "").trim();
args.pwd = $("#login_password").val();
if (!args.usr || !args.pwd) {
login.set_status('{{ _("Both login and password required") }}', 'red');
login.set_status({{ _("Both login and password required") | tojson }}, 'red');
return false;
}
login.call(args);
Expand Down Expand Up @@ -168,7 +169,7 @@ login.signup = function () {

// Login
login.call = function (args, callback, url="/") {
login.set_status('{{ _("Verifying...") }}', 'blue');
login.set_status({{ _("Verifying...") | tojson }}, 'blue');

return frappe.call({
type: "POST",
Expand Down Expand Up @@ -227,13 +228,13 @@ login.login_handlers = (function () {
var login_handlers = {
200: function (data) {
if (data.message == 'Logged In') {
login.set_status('{{ _("Success") }}', 'green');
login.set_status({{ _("Success") | tojson }}, 'green');
document.body.innerHTML = `{% include "templates/includes/splash_screen.html" %}`;
window.location.href = frappe.utils.sanitise_redirect(frappe.utils.get_url_arg("redirect-to")) || data.home_page;
} else if (data.message == 'Password Reset') {
window.location.href = frappe.utils.sanitise_redirect(data.redirect_to);
} else if (data.message == "No App") {
login.set_status("{{ _('Success') }}", 'green');
login.set_status({{ _("Success") | tojson }}, 'green');
if (localStorage) {
var last_visited =
localStorage.getItem("last_visited")
Expand All @@ -252,29 +253,29 @@ login.login_handlers = (function () {
}
} else if (window.location.hash === '#forgot') {
if (data.message === 'not found') {
login.set_status('{{ _("Not a valid user") }}', 'red');
login.set_status({{ _("Not a valid user") | tojson }}, 'red');
} else if (data.message == 'not allowed') {
login.set_status('{{ _("Not Allowed") }}', 'red');
login.set_status({{ _("Not Allowed") | tojson }}, 'red');
} else if (data.message == 'disabled') {
login.set_status('{{ _("Not Allowed: Disabled User") }}', 'red');
login.set_status({{ _("Not Allowed: Disabled User") | tojson }}, 'red');
} else {
login.set_status('{{ _("Instructions Emailed") }}', 'green');
login.set_status({{ _("Instructions Emailed") | tojson }}, 'green');
}


} else if (window.location.hash === '#signup') {
if (cint(data.message[0]) == 0) {
login.set_status(data.message[1], 'red');
} else {
login.set_status('{{ _("Success") }}', 'green');
login.set_status({{ _("Success") | tojson }}, 'green');
frappe.msgprint(data.message[1])
}
//login.set_status(__(data.message), 'green');
}

//OTP verification
if (data.verification && data.message != 'Logged In') {
login.set_status('{{ _("Success") }}', 'green');
login.set_status({{ _("Success") | tojson }}, 'green');

document.cookie = "tmp_id=" + data.tmp_id;

Expand All @@ -287,10 +288,10 @@ login.login_handlers = (function () {
}
}
},
401: get_error_handler('{{ _("Invalid Login. Try again.") }}'),
417: get_error_handler('{{ _("Oops! Something went wrong.") }}'),
404: get_error_handler('{{ _("User does not exist.")}}'),
500: get_error_handler('{{ _("Something went wrong.") }}')
401: get_error_handler({{ _("Invalid Login. Try again.") | tojson }}),
417: get_error_handler({{ _("Oops! Something went wrong.") | tojson }}),
404: get_error_handler({{ _("User does not exist.") | tojson }}),
500: get_error_handler({{ _("Something went wrong.") | tojson }})
};

return login_handlers;
Expand Down Expand Up @@ -322,7 +323,8 @@ var verify_token = function (event) {
args.otp = $("#login_token").val();
args.tmp_id = frappe.get_cookie('tmp_id');
if (!args.otp) {
frappe.msgprint('{{ _("Login token required") }}');
{# striptags is used to remove newlines, e is used for escaping #}
frappe.msgprint("{{ _('Login token required') | striptags | e }}");
return false;
}
login.call(args);
Expand All @@ -336,11 +338,11 @@ var request_otp = function (r) {
`<div id="twofactor_div">
<form class="form-verify">
<div class="page-card-head">
<span class="indicator blue" data-text="Verification">{{ _("Verification") }}</span>
<span class="indicator blue" data-text="Verification">{{ _("Verification") | e }}</span>
</div>
<div id="otp_div"></div>
<input type="text" id="login_token" autocomplete="off" class="form-control" placeholder="{{ _("Verification Code") }}" required="">
<button class="btn btn-sm btn-primary btn-block mt-3" id="verify_token">{{ _("Verify") }}</button>
<input type="text" id="login_token" autocomplete="off" class="form-control" placeholder="{{ _("Verification Code") | e }}" required="">
<button class="btn btn-sm btn-primary btn-block mt-3" id="verify_token">{{ _("Verify") | e }}</button>
</form>
</div>`
);
Expand All @@ -354,11 +356,11 @@ var continue_otp_app = function (setup, qrcode) {
var qrcode_div = $('<div class="text-muted" style="padding-bottom: 15px;"></div>');

if (setup) {
direction = $('<div>').attr('id', 'qr_info').html('{{ _("Enter Code displayed in OTP App.") }}');
direction = $('<div>').attr('id', 'qr_info').text({{ _("Enter Code displayed in OTP App.") | tojson }});
qrcode_div.append(direction);
$('#otp_div').prepend(qrcode_div);
} else {
direction = $('<div>').attr('id', 'qr_info').html('{{ _("OTP setup using OTP App was not completed. Please contact Administrator.") }}');
direction = $('<div>').attr('id', 'qr_info').text({{ _("OTP setup using OTP App was not completed. Please contact Administrator.") | tojson }});
qrcode_div.append(direction);
$('#otp_div').prepend(qrcode_div);
}
Expand All @@ -372,7 +374,7 @@ var continue_sms = function (setup, prompt) {
sms_div.append(prompt)
$('#otp_div').prepend(sms_div);
} else {
direction = $('<div>').attr('id', 'qr_info').html(prompt || '{{ _("SMS was not sent. Please contact Administrator.") }}');
direction = $('<div>').attr('id', 'qr_info').html(prompt || {{ _("SMS was not sent. Please contact Administrator.") | tojson }});
sms_div.append(direction);
$('#otp_div').prepend(sms_div)
}
Expand All @@ -386,7 +388,7 @@ var continue_email = function (setup, prompt) {
email_div.append(prompt)
$('#otp_div').prepend(email_div);
} else {
var direction = $('<div>').attr('id', 'qr_info').html(prompt || '{{ _("Verification code email not sent. Please contact Administrator.") }}');
var direction = $('<div>').attr('id', 'qr_info').html(prompt || {{ _("Verification code email not sent. Please contact Administrator.") | tojson }});
email_div.append(direction);
$('#otp_div').prepend(email_div);
}
Expand Down

0 comments on commit 11baf6e

Please sign in to comment.