Installer: Fehlendes Escaping ergänzt (#3418)

redaxo · Mar 3, 2020 · ed45738 · ed45738
1 parent 93882fd
commit ed45738
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 8 deletions.
diff --git a/redaxo/src/addons/install/pages/packages.add.php b/redaxo/src/addons/install/pages/packages.add.php
@@ -127,10 +127,10 @@
             $content .= '
                 <tr>
                     <td class="rex-table-icon"><i class="rex-icon rex-icon-package"></i></td>
-                    <td data-title="' . $package->i18n('key') . '">' . $key . '</td>
-                    <td data-title="' . $package->i18n('name') . '"><b>' . $addon['name'] . '</b><br /><span class="text-muted">' . rex_escape($addon['author']) . '</span></td>
+                    <td data-title="' . $package->i18n('key') . '">' . rex_escape($key) . '</td>
+                    <td data-title="' . $package->i18n('name') . '"><b>' . rex_escape($addon['name']) . '</b><br /><span class="text-muted">' . rex_escape($addon['author']) . '</span></td>
                     <td data-title="' . $package->i18n('published_on') . '">' . rex_escape(rex_formatter::strftime(reset($addon['files'])['created'])) . '</td>
-                    <td data-title="' . $package->i18n('shortdescription') . '">' . nl2br($addon['shortdescription']) . '</td>
+                    <td data-title="' . $package->i18n('shortdescription') . '">' . nl2br(rex_escape($addon['shortdescription'])) . '</td>
                     <td class="rex-table-action"><span class="text-nowrap"><i class="rex-icon rex-icon-package-exists"></i> ' . $package->i18n('addon_already_exists') . '</span></td>
                 </tr>';
         } else {
@@ -139,7 +139,7 @@
                 <tr data-pjax-scroll-to="0">
                     <td class="rex-table-icon"><a href="' . $url . '"><i class="rex-icon rex-icon-package"></i></a></td>
                     <td data-title="' . $package->i18n('key') . '"><a href="' . $url . '">' . rex_escape($key) . '</a></td>
-                    <td data-title="' . $package->i18n('name') . '"><b>' . rex_escape($addon['name']) . '</b><br /><span class="text-muted">' . $addon['author'] . '</span></td>
+                    <td data-title="' . $package->i18n('name') . '"><b>' . rex_escape($addon['name']) . '</b><br /><span class="text-muted">' . rex_escape($addon['author']) . '</span></td>
                     <td data-title="' . $package->i18n('published_on') . '">' . rex_escape(rex_formatter::strftime(reset($addon['files'])['created'])) . '</td>
                     <td data-title="' . $package->i18n('shortdescription') . '">' . nl2br(rex_escape($addon['shortdescription'])) . '</td>
                     <td class="rex-table-action"><a href="' . $url . '"><i class="rex-icon rex-icon-view"></i> ' . rex_i18n::msg('view') . '</a></td>

diff --git a/redaxo/src/addons/install/pages/packages.upload.php b/redaxo/src/addons/install/pages/packages.upload.php
@@ -110,7 +110,7 @@
 
         $fragment = new rex_fragment();
         $fragment->setVar('class', 'edit', false);
-        $fragment->setVar('title', $addonkey . ' <small>' . $package->i18n($new ? 'file_add' : 'file_edit') . '</small>', false);
+        $fragment->setVar('title', rex_escape($addonkey) . ' <small>' . $package->i18n($new ? 'file_add' : 'file_edit') . '</small>', false);
         $fragment->setVar('body', $panel, false);
         $fragment->setVar('buttons', $buttons, false);
         $content = $fragment->parse('core/page/section.php');
@@ -129,12 +129,12 @@
             $("#rex-js-install-packages-upload-upload-file").change(function(){
                 if($(this).is(":checked"))
                 {
-                    ' . ($newVersion != $file['version'] ? '$("#rex-js-install-packages-upload-version").html(\'<del class="rex-package-old-version">' . $file['version'] . '</del> <ins class="rex-package-new-version">' . $newVersion . '</ins>\');' : '') . '
+                    ' . ($newVersion != $file['version'] ? '$("#rex-js-install-packages-upload-version").html(\'<del class="rex-package-old-version">' . $file['version'] . '</del> <ins class="rex-package-new-version">' . rex_escape($newVersion, 'js') . '</ins>\');' : '') . '
                     $("#rex-js-install-packages-upload-replace-assets, #rex-js-install-packages-upload-ignore-tests").removeAttr("disabled");
                 }
                 else
                 {
-                    $("#rex-js-install-packages-upload-version").html("' . $file['version'] . '");
+                    $("#rex-js-install-packages-upload-version").html("' . rex_escape($file['version'], 'js') . '");
                     $("#rex-js-install-packages-upload-replace-assets, #rex-js-install-packages-upload-ignore-tests").attr("disabled", "disabled");
                 }
             });
@@ -172,7 +172,7 @@
         </table>';
 
         $fragment = new rex_fragment();
-        $fragment->setVar('title', $addonkey . ' <small>' . $package->i18n('information') . '</small>', false);
+        $fragment->setVar('title', rex_escape($addonkey) . ' <small>' . $package->i18n('information') . '</small>', false);
         $fragment->setVar('content', $panel, false);
         $content = $fragment->parse('core/page/section.php');