Changeset 320

Timestamp:

Jun 11, 2018, 4:51:30 PM (6 years ago)

Author:

alloc

Message:

Fixed #152: XSS attacks

Location:

binary-improvements/webserver/js

Files:

• log.js (modified) (1 diff)
• map.js (modified) (1 diff)
• players.js (modified) (1 diff)

binary-improvements/webserver/js/log.js

@@ -21 +21 @@
                                 $("<td>" + data.entries [i].uptime + "</td>").addClass ("logcol_uptime").appendTo (row);
                                 $("<td>" + data.entries [i].type + "</td>").addClass ("logcol_type").appendTo (row);
-                                var msg = $("<td>" + data.entries [i].msg + "</td>").addClass ("logcol_msg").appendTo (row);
+                                var msg = $("<td></td>").text(data.entries [i].msg).addClass ("logcol_msg").appendTo (row);
                                 if (data.entries [i].trace.length > 0) {
                                         msg.append ('<br><div class="trace"><span>' + data.entries [i].trace.replace (/\n/g, "</span><span>") + '</span></div><a class="tracebtn"></a>');

binary-improvements/webserver/js/map.js

@@ -210 +210 @@
                         } else {
                                 marker = L.marker([val.position.x, val.position.z], {icon: playerIcon}).bindPopup(
-                                        "Player: " + val.name +
+                                        "Player: " + $("<div>").text(val.name).html() +
                                         (HasPermission ("webapi.getplayerinventory") ?
                                                 "<br/><a class='inventoryButton' data-steamid='"+val.steamid+"'>Show inventory</a>"

binary-improvements/webserver/js/players.js

@@ -27 +27 @@
                 [ "entityid", "EntityID" ],
                 [ "ip", "IP" ],
-                [ "name", "Name" ],
+                [ "name", "Name",
+                        function(text, data) {
+                                return $("<div>").text(text).html();
+                        }
+                ],
                 [ "online", "Online", null,
                         function(text, data) {