FGFS-4.1/phpvms
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fixing XSS vulnerability by using the proper output tags

Browse Source
This commit is contained in:
Nabeel Shahzad
2018-03-12 17:58:12 -05:00
parent 17f9464208
commit 8076c2d8c1
165 changed files with 1187 additions and 1187 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
modules/Installer/Resources/views/install/index-start.blade.php
View File

@@ -4,9 +4,9 @@
@section('content')
<h2>phpvms installer</h2>
<p>Press continue to start</p>
{!! Form::open(['route' => 'installer.step1', 'method' => 'post']) !!}
{{ Form::open(['route' => 'installer.step1', 'method' => 'post']) }}
<p style="text-align: right">
{!! Form::submit('Start >>', ['class' => 'btn btn-success']) !!}
{{ Form::submit('Start >>', ['class' => 'btn btn-success']) }}
</p>
{!! Form::close() !!}
{{ Form::close() }}
@endsection

18
modules/Installer/Resources/views/install/steps/step1-requirements.blade.php
View File

@@ -3,11 +3,11 @@
@section('content')
<div style="align-content: center;">
{!! Form::open(['route' => 'installer.step2', 'method' => 'GET']) !!}
{{ Form::open(['route' => 'installer.step2', 'method' => 'GET']) }}
<table class="table" width="25%">
<tr><td colspan="2"><h4>php version</h4></td></tr>
<tr>
<td>PHP Version: {!! $php['version'] !!}</td>
<td>PHP Version: {{ $php['version'] }}</td>
<td style="text-align:center;">
@if($php['passed'] === true)
<span class="badge badge-success">OK!</span>
@@ -20,7 +20,7 @@
<tr><td colspan="2"><h4>php extensions</h4></td></tr>
@foreach($extensions as $ext)
<tr>
<td>{!! $ext['ext'] !!}</td>
<td>{{ $ext['ext'] }}</td>
<td style="text-align:center;">
@if($ext['passed'] === true)
<span class="badge badge-success">OK!</span>
@@ -34,7 +34,7 @@
<tr><td colspan="2"><h4>directory permissions</h4></td></tr>
@foreach($directories as $dir)
<tr>
<td>{!! $dir['dir'] !!}</td>
<td>{{ $dir['dir'] }}</td>
<td style="text-align:center;">
@if($dir['passed'] === true)
<span class="badge badge-success">OK!</span>
@@ -47,12 +47,12 @@
</table>
@if($passed === true)
<p style="text-align: right">
{!! Form::submit('Database Setup >>', ['class' => 'btn btn-success']) !!}
{{ Form::submit('Database Setup >>', ['class' => 'btn btn-success']) }}
</p>
@endif
{{--{!! $php_version !!}
{!! $extensions !!}
{!! $passed !!}--}}
{!! Form::close() !!}
{{--{{ $php_version }}
{{ $extensions }}
{{ $passed }}--}}
{{ Form::close() }}
</div>
@endsection

28
modules/Installer/Resources/views/install/steps/step2-db.blade.php
View File

@@ -2,7 +2,7 @@
@section('title', 'Database Setup')
@section('content')
<div style="align-content: center;">
{!! Form::open(['route' => 'installer.envsetup', 'method' => 'POST']) !!}
{{ Form::open(['route' => 'installer.envsetup', 'method' => 'POST']) }}
<table class="table" width="25%">
<tr>
@@ -13,7 +13,7 @@
<td>Site Name</td>
<td style="text-align:center;">
<div class="form-group">
{!! Form::input('text', 'site_name', 'phpvms', ['class' => 'form-control']) !!}
{{ Form::input('text', 'site_name', 'phpvms', ['class' => 'form-control']) }}
</div>
</td>
</tr>
@@ -22,7 +22,7 @@
<td>Site URL</td>
<td style="text-align:center;">
<div class="form-group">
{!! Form::input('text', 'site_url', Request::root(), ['class' => 'form-control']) !!}
{{ Form::input('text', 'site_url', Request::root(), ['class' => 'form-control']) }}
</div>
</td>
</tr>
@@ -35,7 +35,7 @@
<td><p>Select Database Type</p></td>
<td style="text-align:center;">
<div class="form-group">
{!! Form::select('db_conn', $db_types, null, ['class' => 'form-control', 'id' => 'db_conn']) !!}
{{ Form::select('db_conn', $db_types, null, ['class' => 'form-control', 'id' => 'db_conn']) }}
</div>
</td>
</tr>
@@ -45,7 +45,7 @@
<td>Database Host</td>
<td style="text-align:center;">
<div class="form-group">
{!! Form::input('text', 'db_host', '127.0.0.1', ['class' => 'form-control']) !!}
{{ Form::input('text', 'db_host', '127.0.0.1', ['class' => 'form-control']) }}
</div>
</td>
</tr>
@@ -54,7 +54,7 @@
<td>Database Port</td>
<td style="text-align:center;">
<div class="form-group">
{!! Form::input('text', 'db_port', '3306', ['class' => 'form-control']) !!}
{{ Form::input('text', 'db_port', '3306', ['class' => 'form-control']) }}
</div>
</td>
</tr>
@@ -63,7 +63,7 @@
<td>Database Name</td>
<td style="text-align:center;">
<div class="form-group">
{!! Form::input('text', 'db_name', 'phpvms', ['class' => 'form-control']) !!}
{{ Form::input('text', 'db_name', 'phpvms', ['class' => 'form-control']) }}
</div>
</td>
</tr>
@@ -72,7 +72,7 @@
<td>Database User</td>
<td style="text-align:center;">
<div class="form-group">
{!! Form::input('text', 'db_user', null, ['class' => 'form-control']) !!}
{{ Form::input('text', 'db_user', null, ['class' => 'form-control']) }}
</div>
</td>
</tr>
@@ -81,14 +81,14 @@
<td>Database Password</td>
<td style="text-align:center;">
<div class="form-group">
{!! Form::input('text', 'db_pass', null, ['class' => 'form-control']) !!}
{{ Form::input('text', 'db_pass', null, ['class' => 'form-control']) }}
</div>
</td>
</tr>
<tr>
<td colspan="2" style="text-align: right;">
{!! Form::submit('Test Database Credentials', ['class' => 'btn btn-info', 'id' => 'dbtest_button']) !!}
{{ Form::submit('Test Database Credentials', ['class' => 'btn btn-info', 'id' => 'dbtest_button']) }}
</td>
</tr>
</tbody>
@@ -101,7 +101,7 @@
<td>Database Prefix</td>
<td style="text-align:center;">
<div class="form-group">
{!! Form::input('text', 'db_prefix', '', ['class' => 'form-control']) !!}
{{ Form::input('text', 'db_prefix', '', ['class' => 'form-control']) }}
<p>Set this if you're sharing the database with another application.</p>
</div>
</td>
@@ -110,9 +110,9 @@
</table>
<div id="dbtest"></div>
<p style="text-align: right">
{!! Form::submit('Setup Database >>', ['class' => 'btn btn-success']) !!}
{{ Form::submit('Setup Database >>', ['class' => 'btn btn-success']) }}
</p>
{!! Form::close() !!}
{{ Form::close() }}
</div>
@endsection
@@ -143,7 +143,7 @@ $(document).ready(function() {
db_pass: $("input[name=db_pass]").val(),
};
$.post("{!! route('installer.dbtest') !!}", opts, function(data) {
$.post("{{ route('installer.dbtest') }}", opts, function(data) {
$("#dbtest").html(data);
})
})

8
modules/Installer/Resources/views/install/steps/step2a-db_output.blade.php
View File

@@ -2,18 +2,18 @@
@section('title', 'Database Setup Completed')
@section('content')
<div style="align-content: center;">
{!! Form::open(['route' => 'installer.step3', 'method' => 'GET']) !!}
{{ Form::open(['route' => 'installer.step3', 'method' => 'GET']) }}
<pre class="lang-sh">
<code class="lang-sh">
{{--<code class="language-bash">--}}
{!! $console_output !!}
{{ $console_output }}
</code>
</pre>
<p style="text-align: right">
{!! Form::submit('Continue >>', ['class' => 'btn btn-success']) !!}
{{ Form::submit('Continue >>', ['class' => 'btn btn-success']) }}
</p>
{!! Form::close() !!}
{{ Form::close() }}
</div>
@endsection

24
modules/Installer/Resources/views/install/steps/step3-user.blade.php
View File

@@ -4,7 +4,7 @@
@section('content')
<div class="row"><div class="col-md-12">
<div style="align-content: center;">
{!! Form::open(['route' => 'installer.usersetup', 'method' => 'POST']) !!}
{{ Form::open(['route' => 'installer.usersetup', 'method' => 'POST']) }}
<table class="table" width="25%">
<tr>
@@ -15,7 +15,7 @@
<td><p>Airline ICAO</p></td>
<td>
<div class="form-group">
{!! Form::input('text', 'airline_icao', null, ['class' => 'form-control']) !!}
{{ Form::input('text', 'airline_icao', null, ['class' => 'form-control']) }}
@include('installer::flash/check_error', ['field' => 'airline_icao'])
</div>
</td>
@@ -25,7 +25,7 @@
<td><p>Airline Name</p></td>
<td>
<div class="form-group">
{!! Form::input('text', 'airline_name', null, ['class' => 'form-control']) !!}
{{ Form::input('text', 'airline_name', null, ['class' => 'form-control']) }}
@include('installer::flash/check_error', ['field' => 'airline_name'])
</div>
</td>
@@ -35,7 +35,7 @@
<td><p>Airline Country</p></td>
<td>
<div class="form-group">
{!! Form::select('airline_country', $countries, null, ['class' => 'form-control select2' ]); !!}
{{ Form::select('airline_country', $countries, null, ['class' => 'form-control select2' ]) }}
@include('installer::flash/check_error', ['field' => 'airline_country'])
</div>
</td>
@@ -49,7 +49,7 @@
<td><p>Name</p></td>
<td>
<div class="form-group">
{!! Form::input('text', 'name', null, ['class' => 'form-control']) !!}
{{ Form::input('text', 'name', null, ['class' => 'form-control']) }}
@include('installer::flash/check_error', ['field' => 'name'])
</div>
</td>
@@ -59,7 +59,7 @@
<td><p>Email</p></td>
<td>
<div class="form-group">
{!! Form::input('text', 'email', null, ['class' => 'form-control']) !!}
{{ Form::input('text', 'email', null, ['class' => 'form-control']) }}
@include('installer::flash/check_error', ['field' => 'email'])
</div>
</td>
@@ -68,7 +68,7 @@
<tr>
<td><p>Password</p></td>
<td>
{!! Form::password('password', ['class' => 'form-control']) !!}
{{ Form::password('password', ['class' => 'form-control']) }}
@include('installer::flash/check_error', ['field' => 'password'])
</td>
</tr>
@@ -76,7 +76,7 @@
<tr>
<td width="40%"><p>Password Confirm</p></td>
<td>
{!! Form::password('password_confirmation', ['class' => 'form-control']) !!}
{{ Form::password('password_confirmation', ['class' => 'form-control']) }}
@include('installer::flash/check_error', ['field' => 'password_confirmation'])
</td>
</tr>
@@ -90,8 +90,8 @@
<td><p>Analytics</p></td>
<td>
<div class="form-group">
{!! Form::hidden('analytics', 0) !!}
{!! Form::checkbox('analytics', 1, true, ['class' => 'form-control']) !!}
{{ Form::hidden('analytics', 0) }}
{{ Form::checkbox('analytics', 1, true, ['class' => 'form-control']) }}
<br />
<p>
Allows collection of analytics. They won't identify you, and helps us to track
@@ -105,9 +105,9 @@
</table>
<div id="dbtest"></div>
<p style="text-align: right">
{!! Form::submit('Complete Setup >>', ['class' => 'btn btn-success']) !!}
{{ Form::submit('Complete Setup >>', ['class' => 'btn btn-success']) }}
</p>
{!! Form::close() !!}
{{ Form::close() }}
</div>
</div>
</div>

8
modules/Installer/Resources/views/install/steps/step3a-completed.blade.php
View File

@@ -3,7 +3,7 @@
@section('content')
<div style="align-content: center;">
{!! Form::open(['route' => 'installer.complete', 'method' => 'GET']) !!}
{{ Form::open(['route' => 'installer.complete', 'method' => 'GET']) }}
<h4>Installer Completed!</h4>
@@ -11,10 +11,10 @@
<p>Click the button to proceed to the login screen!</p>
<p style="text-align: right">
{!! Form::submit('Install Complete! Continue to Log-In >>',
{{ Form::submit('Install Complete! Continue to Log-In >>',
['class' => 'btn btn-success'])
!!}
}}
</p>
{!! Form::close() !!}
{{ Form::close() }}
</div>
@endsection