github/overleaf
1
0
Fork 0
mirror of https://github.com/overleaf/overleaf.git synced 2025-04-19 18:15:17 +00:00
Code Issues Projects Releases Packages Wiki Activity

Sanitize display of system messages.

Browse source 
When showing system-messages, use default Angular sanitizer, also,
on the admin panel itself, show the verbatim text of the message.

This solves a mild Stored-XSS vulnerability whereby a user could
put `<script>` tags in a message. We don't want that, but we do want
to be able to use basic html tags.
This commit is contained in:
Shane Kilkelly 2018-08-22 10:15:50 +01:00
parent eeadd1e9bb
commit 7f7b10aa09
2 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
services/web/app/views/admin/index.pug
View file

@ -10,8 +10,8 @@ block content
h1 Admin Panel
tabset(ng-cloak)
tab(heading="System Messages")
each message in systemMessages
.alert.alert-info.row-spaced !{message.content}
each message in systemMessages
.alert.alert-info.row-spaced #{message.content}
hr
form(enctype='multipart/form-data', method='post', action='/admin/messages')
input(name="_csrf", type="hidden", value=csrfToken)

4
services/web/public/coffee/main/system-messages.coffee
View file

@ -6,8 +6,8 @@ define [
App.controller "SystemMessageController", ($scope, $sce) ->
$scope.hidden = $.localStorage("systemMessage.hide.#{$scope.message._id}")
$scope.htmlContent = $sce.trustAsHtml $scope.message.content
$scope.htmlContent = $scope.message.content
$scope.hide = () ->
$scope.hidden = true
$.localStorage("systemMessage.hide.#{$scope.message._id}", true)
$.localStorage("systemMessage.hide.#{$scope.message._id}", true)