FGFS-4.1/phpvms
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fixing XSS vulnerability by using the proper output tags

Browse Source
This commit is contained in:
Nabeel Shahzad
2018-03-12 17:58:12 -05:00
parent 17f9464208
commit 8076c2d8c1
165 changed files with 1187 additions and 1187 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
modules/Installer/Resources/views/app.blade.php
View File

@@ -14,10 +14,10 @@
<link rel="stylesheet"
href="https://maxcdn.bootstrapcdn.com/font-awesome/latest/css/font-awesome.min.css"/>
<!-- CSS Files -->
<link href="{!! public_asset('/assets/frontend/css/bootstrap.min.css') !!}" rel="stylesheet"/>
<link href="{!! public_asset('/assets/frontend/css/now-ui-kit.css') !!}" rel="stylesheet"/>
<link href="{!! public_asset('/assets/frontend/css/styles.css') !!}" rel="stylesheet"/>
<link href="{!! public_asset('/assets/system/css/installer.css') !!}" rel="stylesheet"/>
<link href="{{ public_asset('/assets/frontend/css/bootstrap.min.css') }}" rel="stylesheet"/>
<link href="{{ public_asset('/assets/frontend/css/now-ui-kit.css') }}" rel="stylesheet"/>
<link href="{{ public_asset('/assets/frontend/css/styles.css') }}" rel="stylesheet"/>
<link href="{{ public_asset('/assets/system/css/installer.css') }}" rel="stylesheet"/>
{{--<link href="/assets/frontend/css/installer.css" rel="stylesheet"/>--}}
<link rel="stylesheet"
@@ -42,8 +42,8 @@
<span class="navbar-toggler-bar bar3"></span>
</button>
<p class="navbar-brand text-white" data-placement="bottom" target="_blank">
<a href="{!! url('/') !!}">
<img src="{!! public_asset('/assets/frontend/img/logo_blue_bg.svg') !!}" width="135px" style=""/>
<a href="{{ url('/') }}">
<img src="{{ public_asset('/assets/frontend/img/logo_blue_bg.svg') }}" width="135px" style=""/>
</a>
</p>
</div>
@@ -69,7 +69,7 @@
{{--<script src="https://cdn.rawgit.com/google/code-prettify/master/loader/run_prettify.js"></script>--}}
<script src="{!! public_asset('/assets/system/js/installer-vendor.js') !!}" type="text/javascript"></script>
<script src="{{ public_asset('/assets/system/js/installer-vendor.js') }}" type="text/javascript"></script>
{{--<script src="/assets/frontend/js/core/bootstrap.min.js" type="text/javascript"></script>--}}
{{--<script src="/assets/frontend/js/now-ui-kit.js" type="text/javascript"></script>--}}
<script src="//cdnjs.cloudflare.com/ajax/libs/highlight.js/9.12.0/highlight.min.js"></script>

6
modules/Installer/Resources/views/errors/already-installed.blade.php
View File

@@ -3,9 +3,9 @@
@section('content')
<h2>phpVMS already installed!</h2>
<p>phpVMS has already been installed! Please remove the modules/Installer folder.</p>
{!! Form::open(['url' => '/', 'method' => 'get']) !!}
{{ Form::open(['url' => '/', 'method' => 'get']) }}
<p style="text-align: right">
{!! Form::submit('Go to your site >>', ['class' => 'btn btn-success']) !!}
{{ Form::submit('Go to your site >>', ['class' => 'btn btn-success']) }}
</p>
{!! Form::close() !!}
{{ Form::close() }}
@endsection

4
modules/Installer/Resources/views/flash/check_error.blade.php
View File

@@ -1,6 +1,6 @@
@if($errors->has($field))
<p class="text-danger" style="margin-top: 10px;">{!! $errors->first($field); !!}</p>
<p class="text-danger" style="margin-top: 10px;">{{ $errors->first($field) }}</p>
{{--<div class="alert alert-danger" role="alert" style="margin-top: 10px;">
{!! $errors->first($field); !!}
{{ $errors->first($field) }}
</div>--}}
@endif

4
modules/Installer/Resources/views/flash/dbtest.blade.php
View File

@@ -1,8 +1,8 @@
<div class="alert alert-{!! $status !!}" role="alert">
<div class="alert alert-{{ $status }}" role="alert">
<div class="container">
<div class="alert-icon">
<i class="now-ui-icons ui-1_bell-53"></i>
</div>
{!! $message !!}
{{ $message }}
</div>
</div>

2
modules/Installer/Resources/views/flash/message.blade.php
View File

@@ -4,7 +4,7 @@
<div class="alert-icon">
<i class="now-ui-icons ui-2_like"></i>
</div>
{!! $message['message'] !!}
{{ $message['message'] }}
</div>
</div>
@endforeach

6
modules/Installer/Resources/views/install/index-start.blade.php
View File

@@ -4,9 +4,9 @@
@section('content')
<h2>phpvms installer</h2>
<p>Press continue to start</p>
{!! Form::open(['route' => 'installer.step1', 'method' => 'post']) !!}
{{ Form::open(['route' => 'installer.step1', 'method' => 'post']) }}
<p style="text-align: right">
{!! Form::submit('Start >>', ['class' => 'btn btn-success']) !!}
{{ Form::submit('Start >>', ['class' => 'btn btn-success']) }}
</p>
{!! Form::close() !!}
{{ Form::close() }}
@endsection

18
modules/Installer/Resources/views/install/steps/step1-requirements.blade.php
View File

@@ -3,11 +3,11 @@
@section('content')
<div style="align-content: center;">
{!! Form::open(['route' => 'installer.step2', 'method' => 'GET']) !!}
{{ Form::open(['route' => 'installer.step2', 'method' => 'GET']) }}
<table class="table" width="25%">
<tr><td colspan="2"><h4>php version</h4></td></tr>
<tr>
<td>PHP Version: {!! $php['version'] !!}</td>
<td>PHP Version: {{ $php['version'] }}</td>
<td style="text-align:center;">
@if($php['passed'] === true)
<span class="badge badge-success">OK!</span>
@@ -20,7 +20,7 @@
<tr><td colspan="2"><h4>php extensions</h4></td></tr>
@foreach($extensions as $ext)
<tr>
<td>{!! $ext['ext'] !!}</td>
<td>{{ $ext['ext'] }}</td>
<td style="text-align:center;">
@if($ext['passed'] === true)
<span class="badge badge-success">OK!</span>
@@ -34,7 +34,7 @@
<tr><td colspan="2"><h4>directory permissions</h4></td></tr>
@foreach($directories as $dir)
<tr>
<td>{!! $dir['dir'] !!}</td>
<td>{{ $dir['dir'] }}</td>
<td style="text-align:center;">
@if($dir['passed'] === true)
<span class="badge badge-success">OK!</span>
@@ -47,12 +47,12 @@
</table>
@if($passed === true)
<p style="text-align: right">
{!! Form::submit('Database Setup >>', ['class' => 'btn btn-success']) !!}
{{ Form::submit('Database Setup >>', ['class' => 'btn btn-success']) }}
</p>
@endif
{{--{!! $php_version !!}
{!! $extensions !!}
{!! $passed !!}--}}
{!! Form::close() !!}
{{--{{ $php_version }}
{{ $extensions }}
{{ $passed }}--}}
{{ Form::close() }}
</div>
@endsection

28
modules/Installer/Resources/views/install/steps/step2-db.blade.php
View File

@@ -2,7 +2,7 @@
@section('title', 'Database Setup')
@section('content')
<div style="align-content: center;">
{!! Form::open(['route' => 'installer.envsetup', 'method' => 'POST']) !!}
{{ Form::open(['route' => 'installer.envsetup', 'method' => 'POST']) }}
<table class="table" width="25%">
<tr>
@@ -13,7 +13,7 @@
<td>Site Name</td>
<td style="text-align:center;">
<div class="form-group">
{!! Form::input('text', 'site_name', 'phpvms', ['class' => 'form-control']) !!}
{{ Form::input('text', 'site_name', 'phpvms', ['class' => 'form-control']) }}
</div>
</td>
</tr>
@@ -22,7 +22,7 @@
<td>Site URL</td>
<td style="text-align:center;">
<div class="form-group">
{!! Form::input('text', 'site_url', Request::root(), ['class' => 'form-control']) !!}
{{ Form::input('text', 'site_url', Request::root(), ['class' => 'form-control']) }}
</div>
</td>
</tr>
@@ -35,7 +35,7 @@
<td><p>Select Database Type</p></td>
<td style="text-align:center;">
<div class="form-group">
{!! Form::select('db_conn', $db_types, null, ['class' => 'form-control', 'id' => 'db_conn']) !!}
{{ Form::select('db_conn', $db_types, null, ['class' => 'form-control', 'id' => 'db_conn']) }}
</div>
</td>
</tr>
@@ -45,7 +45,7 @@
<td>Database Host</td>
<td style="text-align:center;">
<div class="form-group">
{!! Form::input('text', 'db_host', '127.0.0.1', ['class' => 'form-control']) !!}
{{ Form::input('text', 'db_host', '127.0.0.1', ['class' => 'form-control']) }}
</div>
</td>
</tr>
@@ -54,7 +54,7 @@
<td>Database Port</td>
<td style="text-align:center;">
<div class="form-group">
{!! Form::input('text', 'db_port', '3306', ['class' => 'form-control']) !!}
{{ Form::input('text', 'db_port', '3306', ['class' => 'form-control']) }}
</div>
</td>
</tr>
@@ -63,7 +63,7 @@
<td>Database Name</td>
<td style="text-align:center;">
<div class="form-group">
{!! Form::input('text', 'db_name', 'phpvms', ['class' => 'form-control']) !!}
{{ Form::input('text', 'db_name', 'phpvms', ['class' => 'form-control']) }}
</div>
</td>
</tr>
@@ -72,7 +72,7 @@
<td>Database User</td>
<td style="text-align:center;">
<div class="form-group">
{!! Form::input('text', 'db_user', null, ['class' => 'form-control']) !!}
{{ Form::input('text', 'db_user', null, ['class' => 'form-control']) }}
</div>
</td>
</tr>
@@ -81,14 +81,14 @@
<td>Database Password</td>
<td style="text-align:center;">
<div class="form-group">
{!! Form::input('text', 'db_pass', null, ['class' => 'form-control']) !!}
{{ Form::input('text', 'db_pass', null, ['class' => 'form-control']) }}
</div>
</td>
</tr>
<tr>
<td colspan="2" style="text-align: right;">
{!! Form::submit('Test Database Credentials', ['class' => 'btn btn-info', 'id' => 'dbtest_button']) !!}
{{ Form::submit('Test Database Credentials', ['class' => 'btn btn-info', 'id' => 'dbtest_button']) }}
</td>
</tr>
</tbody>
@@ -101,7 +101,7 @@
<td>Database Prefix</td>
<td style="text-align:center;">
<div class="form-group">
{!! Form::input('text', 'db_prefix', '', ['class' => 'form-control']) !!}
{{ Form::input('text', 'db_prefix', '', ['class' => 'form-control']) }}
<p>Set this if you're sharing the database with another application.</p>
</div>
</td>
@@ -110,9 +110,9 @@
</table>
<div id="dbtest"></div>
<p style="text-align: right">
{!! Form::submit('Setup Database >>', ['class' => 'btn btn-success']) !!}
{{ Form::submit('Setup Database >>', ['class' => 'btn btn-success']) }}
</p>
{!! Form::close() !!}
{{ Form::close() }}
</div>
@endsection
@@ -143,7 +143,7 @@ $(document).ready(function() {
db_pass: $("input[name=db_pass]").val(),
};
$.post("{!! route('installer.dbtest') !!}", opts, function(data) {
$.post("{{ route('installer.dbtest') }}", opts, function(data) {
$("#dbtest").html(data);
})
})

8
modules/Installer/Resources/views/install/steps/step2a-db_output.blade.php
View File

@@ -2,18 +2,18 @@
@section('title', 'Database Setup Completed')
@section('content')
<div style="align-content: center;">
{!! Form::open(['route' => 'installer.step3', 'method' => 'GET']) !!}
{{ Form::open(['route' => 'installer.step3', 'method' => 'GET']) }}
<pre class="lang-sh">
<code class="lang-sh">
{{--<code class="language-bash">--}}
{!! $console_output !!}
{{ $console_output }}
</code>
</pre>
<p style="text-align: right">
{!! Form::submit('Continue >>', ['class' => 'btn btn-success']) !!}
{{ Form::submit('Continue >>', ['class' => 'btn btn-success']) }}
</p>
{!! Form::close() !!}
{{ Form::close() }}
</div>
@endsection

24
modules/Installer/Resources/views/install/steps/step3-user.blade.php
View File

@@ -4,7 +4,7 @@
@section('content')
<div class="row"><div class="col-md-12">
<div style="align-content: center;">
{!! Form::open(['route' => 'installer.usersetup', 'method' => 'POST']) !!}
{{ Form::open(['route' => 'installer.usersetup', 'method' => 'POST']) }}
<table class="table" width="25%">
<tr>
@@ -15,7 +15,7 @@
<td><p>Airline ICAO</p></td>
<td>
<div class="form-group">
{!! Form::input('text', 'airline_icao', null, ['class' => 'form-control']) !!}
{{ Form::input('text', 'airline_icao', null, ['class' => 'form-control']) }}
@include('installer::flash/check_error', ['field' => 'airline_icao'])
</div>
</td>
@@ -25,7 +25,7 @@
<td><p>Airline Name</p></td>
<td>
<div class="form-group">
{!! Form::input('text', 'airline_name', null, ['class' => 'form-control']) !!}
{{ Form::input('text', 'airline_name', null, ['class' => 'form-control']) }}
@include('installer::flash/check_error', ['field' => 'airline_name'])
</div>
</td>
@@ -35,7 +35,7 @@
<td><p>Airline Country</p></td>
<td>
<div class="form-group">
{!! Form::select('airline_country', $countries, null, ['class' => 'form-control select2' ]); !!}
{{ Form::select('airline_country', $countries, null, ['class' => 'form-control select2' ]) }}
@include('installer::flash/check_error', ['field' => 'airline_country'])
</div>
</td>
@@ -49,7 +49,7 @@
<td><p>Name</p></td>
<td>
<div class="form-group">
{!! Form::input('text', 'name', null, ['class' => 'form-control']) !!}
{{ Form::input('text', 'name', null, ['class' => 'form-control']) }}
@include('installer::flash/check_error', ['field' => 'name'])
</div>
</td>
@@ -59,7 +59,7 @@
<td><p>Email</p></td>
<td>
<div class="form-group">
{!! Form::input('text', 'email', null, ['class' => 'form-control']) !!}
{{ Form::input('text', 'email', null, ['class' => 'form-control']) }}
@include('installer::flash/check_error', ['field' => 'email'])
</div>
</td>
@@ -68,7 +68,7 @@
<tr>
<td><p>Password</p></td>
<td>
{!! Form::password('password', ['class' => 'form-control']) !!}
{{ Form::password('password', ['class' => 'form-control']) }}
@include('installer::flash/check_error', ['field' => 'password'])
</td>
</tr>
@@ -76,7 +76,7 @@
<tr>
<td width="40%"><p>Password Confirm</p></td>
<td>
{!! Form::password('password_confirmation', ['class' => 'form-control']) !!}
{{ Form::password('password_confirmation', ['class' => 'form-control']) }}
@include('installer::flash/check_error', ['field' => 'password_confirmation'])
</td>
</tr>
@@ -90,8 +90,8 @@
<td><p>Analytics</p></td>
<td>
<div class="form-group">
{!! Form::hidden('analytics', 0) !!}
{!! Form::checkbox('analytics', 1, true, ['class' => 'form-control']) !!}
{{ Form::hidden('analytics', 0) }}
{{ Form::checkbox('analytics', 1, true, ['class' => 'form-control']) }}
<br />
<p>
Allows collection of analytics. They won't identify you, and helps us to track
@@ -105,9 +105,9 @@
</table>
<div id="dbtest"></div>
<p style="text-align: right">
{!! Form::submit('Complete Setup >>', ['class' => 'btn btn-success']) !!}
{{ Form::submit('Complete Setup >>', ['class' => 'btn btn-success']) }}
</p>
{!! Form::close() !!}
{{ Form::close() }}
</div>
</div>
</div>

8
modules/Installer/Resources/views/install/steps/step3a-completed.blade.php
View File

@@ -3,7 +3,7 @@
@section('content')
<div style="align-content: center;">
{!! Form::open(['route' => 'installer.complete', 'method' => 'GET']) !!}
{{ Form::open(['route' => 'installer.complete', 'method' => 'GET']) }}
<h4>Installer Completed!</h4>
@@ -11,10 +11,10 @@
<p>Click the button to proceed to the login screen!</p>
<p style="text-align: right">
{!! Form::submit('Install Complete! Continue to Log-In >>',
{{ Form::submit('Install Complete! Continue to Log-In >>',
['class' => 'btn btn-success'])
!!}
}}
</p>
{!! Form::close() !!}
{{ Form::close() }}
</div>
@endsection

6
modules/Installer/Resources/views/update/index-start.blade.php
View File

@@ -4,9 +4,9 @@
@section('content')
<h2>phpvms updater</h2>
<p>Press continue to check if there are any updates available.</p>
{!! Form::open(['route' => 'update.step1', 'method' => 'post']) !!}
{{ Form::open(['route' => 'update.step1', 'method' => 'post']) }}
<p style="text-align: right">
{!! Form::submit('Start >>', ['class' => 'btn btn-success']) !!}
{{ Form::submit('Start >>', ['class' => 'btn btn-success']) }}
</p>
{!! Form::close() !!}
{{ Form::close() }}
@endsection

6
modules/Installer/Resources/views/update/steps/step1-no-update.blade.php
View File

@@ -4,10 +4,10 @@
@section('content')
<h2>phpvms updater</h2>
<p>It seems like you're up to date!</p>
{!! Form::open(['route' => 'update.complete', 'method' => 'GET']) !!}
{{ Form::open(['route' => 'update.complete', 'method' => 'GET']) }}
<p style="text-align: right">
{!! Form::submit('Complete >>', ['class' => 'btn btn-success']) !!}
{{ Form::submit('Complete >>', ['class' => 'btn btn-success']) }}
</p>
{!! Form::close() !!}
{{ Form::close() }}
@endsection

6
modules/Installer/Resources/views/update/steps/step1-update-available.blade.php
View File

@@ -4,9 +4,9 @@
@section('content')
<h2>phpvms updater</h2>
<p>Updates have been found, click run to complete the update!.</p>
{!! Form::open(['route' => 'update.run_migrations', 'method' => 'post']) !!}
{{ Form::open(['route' => 'update.run_migrations', 'method' => 'post']) }}
<p style="text-align: right">
{!! Form::submit('Run >>', ['class' => 'btn btn-success']) !!}
{{ Form::submit('Run >>', ['class' => 'btn btn-success']) }}
</p>
{!! Form::close() !!}
{{ Form::close() }}
@endsection

8
modules/Installer/Resources/views/update/steps/step2-migrations-done.blade.php
View File

@@ -2,17 +2,17 @@
@section('title', 'Update Completed')
@section('content')
<div style="align-content: center;">
{!! Form::open(['route' => 'update.complete', 'method' => 'GET']) !!}
{{ Form::open(['route' => 'update.complete', 'method' => 'GET']) }}
<pre class="lang-sh">
<code class="lang-sh">
{!! $console_output !!}
{{ $console_output }}
</code>
</pre>
<p style="text-align: right">
{!! Form::submit('Complete >>', ['class' => 'btn btn-success']) !!}
{{ Form::submit('Complete >>', ['class' => 'btn btn-success']) }}
</p>
{!! Form::close() !!}
{{ Form::close() }}
</div>
@endsection

4
modules/Sample/Resources/views/admin/index.blade.php
View File

@@ -3,7 +3,7 @@
@section('title', 'Sample')
@section('actions')
<li>
<a href="{!! url('/admin/sample/create') !!}">
<a href="{{ url('/admin/sample/create') }}">
<i class="ti-plus"></i>
Add New</a>
</li>
@@ -12,7 +12,7 @@
<div class="card border-blue-bottom">
<div class="content">
<div class="header"><h4 class="title">Admin Scaffold!</h4></div>
<p>This view is loaded from module: {!! config('sample.name') !!}</p>
<p>This view is loaded from module: {{ config('sample.name') }}</p>
</div>
</div>
@endsection

2
modules/Sample/Resources/views/index.blade.php
View File

@@ -4,6 +4,6 @@
<h1>Hello World</h1>
<p>
This view is loaded from module: {!! config('sample.name') !!}
This view is loaded from module: {{ config('sample.name') }}
</p>
@endsection