Bladeren bron

LTI using remove xss - refs BT#13469

Angel Fernando Quiroz Campos 6 jaren geleden
bovenliggende
commit
6bae0d27aa

+ 0 - 2
plugin/ims_lti/src/Form/FrmAdd.php

@@ -72,8 +72,6 @@ class FrmAdd extends FormValidator
         $this->addCheckBox('share_picture', null, $plugin->get_lang('ShareLauncherPicture'));
         $this->addHtml('</div>');
         $this->addButtonCreate($plugin->get_lang('AddExternalTool'));
-        $this->applyFilter('__ALL__', 'Security::remove_XSS');
-        $this->applyFilter('__ALL__', 'htmlspecialchars_decode');
         $this->applyFilter('__ALL__', 'trim');
     }
 

+ 0 - 2
plugin/ims_lti/src/Form/FrmEdit.php

@@ -91,8 +91,6 @@ class FrmEdit extends FormValidator
         $this->addButtonUpdate($plugin->get_lang('EditExternalTool'));
         $this->addHidden('id', $this->tool->getId());
         $this->addHidden('action', 'edit');
-        $this->applyFilter('__ALL__', 'Security::remove_XSS');
-        $this->applyFilter('__ALL__', 'htmlspecialchars_decode');
         $this->applyFilter('__ALL__', 'trim');
     }
 

+ 4 - 2
plugin/ims_lti/start.php

@@ -18,7 +18,9 @@ if (!$tool) {
 
 $imsLtiPlugin = ImsLtiPlugin::create();
 
-$template = new Template($tool->getName());
+$pageTitle = Security::remove_XSS($tool->getName());
+
+$template = new Template($pageTitle);
 $template->assign('tool', $tool);
 $template->assign(
     'launch_url',
@@ -27,6 +29,6 @@ $template->assign(
 
 $content = $template->fetch('ims_lti/view/start.tpl');
 
-$template->assign('header', $tool->getName());
+$template->assign('header', $pageTitle);
 $template->assign('content', $content);
 $template->display_one_col_template();

+ 2 - 2
plugin/ims_lti/view/add.tpl

@@ -20,7 +20,7 @@
                                         {{ 'edit.png'|img(22, 'Edit'|get_lang) }}
                                     </a>
                                 </div>
-                                {{ tool.name }}
+                                {{ tool.name|e }}
                             </li>
                         {% endfor %}
                     </ul>
@@ -46,7 +46,7 @@
                                         </a>
                                     {% endif %}
                                 </div>
-                                {{ tool.name }}
+                                {{ tool.name|e }}
                             </li>
                         {% endfor %}
                     </ul>

+ 43 - 41
plugin/ims_lti/view/admin.tpl

@@ -1,43 +1,45 @@
-{{ 'ImsLtiDescription'|get_plugin_lang('ImsLtiPlugin') }}
-<div class="btn-toolbar">
-    <a href="{{ _p.web_plugin }}ims_lti/create.php" class="btn btn-primary">
-        <span class="fa fa-plus fa-fw" aria-hidden="true"></span> {{ 'AddExternalTool'|get_plugin_lang('ImsLtiPlugin') }}
-    </a>
-</div>
-<div class="table-responsive">
-    <table class="table table-striped table-hover">
-        <thead>
-            <tr>
-                <th>{{ 'Name'|get_lang }}</th>
-                <th>{{ 'LaunchUrl'|get_plugin_lang('ImsLtiPlugin') }}</th>
-                <th class="text-center">{{ 'IsGlobal'|get_plugin_lang('ImsLtiPlugin') }}</th>
-                <th class="text-right">{{ 'Actions'|get_lang }}</th>
-            </tr>
-        </thead>
-        <tbody>
-            {% for tool in tools %}
+{% autoescape 'html' %}
+    {{ 'ImsLtiDescription'|get_plugin_lang('ImsLtiPlugin') }}
+    <div class="btn-toolbar">
+        <a href="{{ _p.web_plugin }}ims_lti/create.php" class="btn btn-primary">
+            <span class="fa fa-plus fa-fw" aria-hidden="true"></span> {{ 'AddExternalTool'|get_plugin_lang('ImsLtiPlugin') }}
+        </a>
+    </div>
+    <div class="table-responsive">
+        <table class="table table-striped table-hover">
+            <thead>
                 <tr>
-                    <td>{{ tool.name }}</td>
-                    <td>{{ tool.launchUrl }}</td>
-                    <td class="text-center">
-                        {% if tool.isGlobal %}
-                            <span class="fa fa-check-square-o" aria-hidden="true"></span>
-                            <span class="sr-only">{{ 'Yes'|get_lang }}</span>
-                        {% else %}
-                            <span class="fa fa-square-o" aria-hidden="true"></span>
-                            <span class="sr-only">{{ 'No'|get_lang }}</span>
-                        {% endif %}
-                    </td>
-                    <td class="text-right">
-                        <a href="{{ _p.web_plugin }}ims_lti/edit.php?{{ {'id': tool.id}|url_encode() }}" class="btn btn-success">
-                            <span class="fa fa-edit fa-fw" aria-hidden="true"></span> {{ 'Edit'|get_lang }}
-                        </a>
-                        <a href="{{ _p.web_plugin }}ims_lti/delete.php?{{ {'id': tool.id}|url_encode() }}" class="btn btn-danger">
-                            <span class="fa fa-times fa-fw" aria-hidden="true"></span> {{ 'Delete'|get_lang }}
-                        </a>
-                    </td>
+                    <th>{{ 'Name'|get_lang }}</th>
+                    <th>{{ 'LaunchUrl'|get_plugin_lang('ImsLtiPlugin') }}</th>
+                    <th class="text-center">{{ 'IsGlobal'|get_plugin_lang('ImsLtiPlugin') }}</th>
+                    <th class="text-right">{{ 'Actions'|get_lang }}</th>
                 </tr>
-            {% endfor %}
-        </tbody>
-    </table>
-</div>
+            </thead>
+            <tbody>
+                {% for tool in tools %}
+                    <tr>
+                        <td>{{ tool.name }}</td>
+                        <td>{{ tool.launchUrl }}</td>
+                        <td class="text-center">
+                            {% if tool.isGlobal %}
+                                <span class="fa fa-check-square-o" aria-hidden="true"></span>
+                                <span class="sr-only">{{ 'Yes'|get_lang }}</span>
+                            {% else %}
+                                <span class="fa fa-square-o" aria-hidden="true"></span>
+                                <span class="sr-only">{{ 'No'|get_lang }}</span>
+                            {% endif %}
+                        </td>
+                        <td class="text-right">
+                            <a href="{{ _p.web_plugin }}ims_lti/edit.php?{{ {'id': tool.id}|url_encode() }}" class="btn btn-success">
+                                <span class="fa fa-edit fa-fw" aria-hidden="true"></span> {{ 'Edit'|get_lang }}
+                            </a>
+                            <a href="{{ _p.web_plugin }}ims_lti/delete.php?{{ {'id': tool.id}|url_encode() }}" class="btn btn-danger">
+                                <span class="fa fa-times fa-fw" aria-hidden="true"></span> {{ 'Delete'|get_lang }}
+                            </a>
+                        </td>
+                    </tr>
+                {% endfor %}
+            </tbody>
+        </table>
+    </div>
+{% endautoescape %}

+ 1 - 1
plugin/ims_lti/view/start.tpl

@@ -1,5 +1,5 @@
 {%  if tool.description %}
-    <p class="lead">{{ tool.description|nl2br }}</p>
+    <p class="lead">{{ tool.description|e|nl2br }}</p>
 {%  endif %}
 <div class="embed-responsive embed-responsive-4by3">
     <iframe src="{{ launch_url }}" class="plugin-ims-lti-iframe"></iframe>