mirrors/btcpayserver
1
0
Fork 0
mirror of https://github.com/btcpayserver/btcpayserver.git synced 2025-02-21 14:04:12 +01:00
Code Issues Projects Releases Packages Wiki Activity

Fix Summernote XSS possibility (#2859)

Browse source
This commit is contained in:
d11n 2021-09-09 15:49:30 +02:00 • committed by GitHub
parent 6f75125cf5
commit 650df97e50
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
5 changed files with 18 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
BTCPayServer/wwwroot/crowdfund-admin/main.js
View file

@ -1,4 +1,4 @@
hljs.initHighlightingOnLoad();
$(document).ready(function () {
$(".richtext").summernote(window.summernoteOptions || {});
$(".richtext").summernote(window.summernoteOptions());
});

18
BTCPayServer/wwwroot/js/summernote-options.js
View file

@ -1,8 +1,12 @@
window.summernoteOptions = {
minHeight: 300,
tableClassName: 'table table-sm',
insertTableMaxSize: {
col: 5,
row: 10
window.summernoteOptions = function() {
return {
minHeight: 300,
tableClassName: 'table table-sm',
insertTableMaxSize: {
col: 5,
row: 10
},
codeviewFilter: true,
codeviewFilterRegex: new RegExp($.summernote.options.codeviewFilterRegex.source + '|<.*?( on\\w+?=.*?)>', 'gi')
}
};
}

2
BTCPayServer/wwwroot/payment-request-admin/main.js
View file

@ -1,3 +1,3 @@
$(document).ready(function() {
$(".richtext").summernote(window.summernoteOptions || {});
$(".richtext").summernote(window.summernoteOptions());
});

2
BTCPayServer/wwwroot/pos-admin/main.js
View file

@ -1,4 +1,4 @@
hljs.initHighlightingOnLoad();
$(document).ready(function () {
$(".richtext").summernote(window.summernoteOptions || {});
$(".richtext").summernote(window.summernoteOptions());
});

5
BTCPayServer/wwwroot/vendor/summernote/summernote-bs5.js vendored
View file

@ -1,4 +1,4 @@
/*!
/*!
*
* Super simple wysiwyg editor v0.8.18
* https://summernote.org
@ -5366,6 +5366,9 @@ var Editor_Editor = /*#__PURE__*/function () {
// if url doesn't have any protocol and not even a relative or a label, use http:// as default
linkUrl = /^([A-Za-z][A-Za-z0-9+-.]*\:|#|\/)/.test(linkUrl) ? linkUrl : _this.options.defaultProtocol + linkUrl;
}
linkUrl = linkUrl.replace(this.options.codeviewFilterRegex, '');
linkText = linkText.replace(this.options.codeviewFilterRegex, '');
var anchors = [];