LupusNobilis
/
sogo
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Revert "Properly escape the foldername to avoid XSS issues" 

This reverts commit 045b275b27.
maint-2.1.1
Ludovic Marcotte 2013-06-27 11:15:41 -04:00
parent 045b275b27
commit e26e3d7307
2 changed files with 5 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
UI/WebServerResources/SchedulerUI.js
View File

@ -3076,7 +3076,9 @@ function appendCalendar(folderName, folderPath) {
var colorBox = document.createElement("div");
li.appendChild(colorBox);
li.appendChild(document.createTextNode(folderName));
li.appendChild(document.createTextNode(folderName
.replace("&lt;", "<", "g")
.replace("&gt;", ">", "g")));
colorBox.appendChild(document.createTextNode("OO"));
$(colorBox).addClassName("colorBox");
@ -3117,7 +3119,7 @@ function appendStyleElement(folderPath, color) {
function onFolderSubscribeCB(folderData) {
var folder = $(folderData["folder"]);
if (!folder) {
appendCalendar(folderData["folderName"].unescapeHTML(), folderData["folder"]);
appendCalendar(folderData["folderName"], folderData["folder"]);
refreshEvents();
refreshTasks();
changeCalendarDisplay();

6
UI/WebServerResources/UIxContactsUserFolders.js
View File

@ -192,11 +192,7 @@ function addFolderBranchToTree(tree, user, folder, nodeId, subId, isLast) {
else
icon += 'calendar-folder-16x16.png';
var folderId = user + ":" + folderInfos[1].substr(1);
// name has the format "Foldername (Firstname Lastname <email>)"
// We sanitize the value to avoid XSS issues
var name = folderInfos[0].escapeHTML();
var name = folderInfos[0]; // name has the format "Folername (Firstname Lastname <email>)"
var pos = name.lastIndexOf(' (');
if (pos > -1)
name = name.substring(0, pos); // strip the part with fullname and email