FGFS-4.1/phpvms
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fixing XSS vulnerability by using the proper output tags

Browse Source
This commit is contained in:
Nabeel Shahzad
2018-03-12 17:58:12 -05:00
parent 17f9464208
commit 8076c2d8c1
165 changed files with 1187 additions and 1187 deletions
Download Patch File Download Diff File Expand all files Collapse all files
resources/views/admin/aircraft/create.blade.php
+2 -2
View File
@@ -8,9 +8,9 @@
You must add a subfleet before you can add an aircraft!
</p>
@else
{!! Form::open(['route' => 'admin.aircraft.store']) !!}
{{ Form::open(['route' => 'admin.aircraft.store']) }}
@include('admin.aircraft.fields')
{!! Form::close() !!}
{{ Form::close() }}
@endif
</div>
</div>
resources/views/admin/aircraft/edit.blade.php
+2 -2
View File
@@ -3,9 +3,9 @@
@section('content')
<div class="card border-blue-bottom">
<div class="content">
{!! Form::model($aircraft, ['route' => ['admin.aircraft.update', $aircraft->id], 'method' => 'patch']) !!}
{{ Form::model($aircraft, ['route' => ['admin.aircraft.update', $aircraft->id], 'method' => 'patch']) }}
@include('admin.aircraft.fields')
{!! Form::close() !!}
{{ Form::close() }}
</div>
</div>
resources/views/admin/aircraft/expenses.blade.php
+21 -21
View File
@@ -11,7 +11,7 @@
@if(count($aircraft->expenses))
<thead>
<th>Name</th>
<th>Cost&nbsp;<span class="small">{!! currency(config('phpvms.currency')) !!}</span></th>
<th>Cost&nbsp;<span class="small">{{ currency(config('phpvms.currency')) }}</span></th>
<th>Type</th>
<th></th>
</thead>
@@ -22,33 +22,33 @@
<tr>
<td>
<p>
<a class="text" href="#" data-pk="{!! $expense->id !!}"
data-name="name">{!! $expense->name !!}</a>
<a class="text" href="#" data-pk="{{ $expense->id }}"
data-name="name">{{ $expense->name }}</a>
</p>
</td>
<td>
<p>
<a class="text" href="#" data-pk="{!! $expense->id !!}"
data-name="amount">{!! $expense->amount !!}</a>
<a class="text" href="#" data-pk="{{ $expense->id }}"
data-name="amount">{{ $expense->amount }}</a>
</p>
</td>
<td>
<p>
<a href="#"
class="dropdown"
data-pk="{!! $expense->id !!}"
data-name="type">{!! \App\Models\Enums\ExpenseType::label($expense->type) !!}</a>
data-pk="{{ $expense->id }}"
data-name="type">{{ \App\Models\Enums\ExpenseType::label($expense->type) }}</a>
</p>
</td>
<td align="right">
{!! Form::open(['url' => url('/admin/aircraft/'.$aircraft->id.'/expenses'),
'method' => 'delete', 'class' => 'modify_expense form-inline']) !!}
{!! Form::hidden('expense_id', $expense->id) !!}
{!! Form::button('<i class="fa fa-times"></i>', ['type' => 'submit',
{{ Form::open(['url' => url('/admin/aircraft/'.$aircraft->id.'/expenses'),
'method' => 'delete', 'class' => 'modify_expense form-inline']) }}
{{ Form::hidden('expense_id', $expense->id) }}
{{ Form::button('<i class="fa fa-times"></i>', ['type' => 'submit',
'class' => 'btn btn-sm btn-danger btn-icon',
'onclick' => "return confirm('Are you sure?')",
]) !!}
{!! Form::close() !!}
]) }}
{{ Form::close() }}
</td>
</tr>
@endforeach
@@ -58,14 +58,14 @@
<div class="row">
<div class="col-sm-12">
<div class="text-right">
{!! Form::open(['url' => url('/admin/aircraft/'.$aircraft->id.'/expenses'),
'method' => 'post', 'class' => 'modify_expense form-inline']) !!}
{!! Form::input('text', 'name', null, ['class' => 'form-control input-sm', 'placeholder' => 'Name']) !!}
{!! Form::number('amount', null, ['class' => 'form-control input-sm', 'placeholder' => 'Amount']) !!}
{!! Form::select('type', \App\Models\Enums\ExpenseType::select(), null, ['class' => 'select2']) !!}
{!! Form::button('<i class="fa fa-plus"></i> Add', ['type' => 'submit',
'class' => 'btn btn-success btn-small']) !!}
{!! Form::close() !!}
{{ Form::open(['url' => url('/admin/aircraft/'.$aircraft->id.'/expenses'),
'method' => 'post', 'class' => 'modify_expense form-inline']) }}
{{ Form::input('text', 'name', null, ['class' => 'form-control input-sm', 'placeholder' => 'Name']) }}
{{ Form::number('amount', null, ['class' => 'form-control input-sm', 'placeholder' => 'Amount']) }}
{{ Form::select('type', \App\Models\Enums\ExpenseType::select(), null, ['class' => 'select2']) }}
{{ Form::button('<i class="fa fa-plus"></i> Add', ['type' => 'submit',
'class' => 'btn btn-success btn-small']) }}
{{ Form::close() }}
<p class="text-danger">{{ $errors->first('name') }}</p>
<p class="text-danger">{{ $errors->first('amount') }}</p>
resources/views/admin/aircraft/fields.blade.php
+14 -14
View File
@@ -1,43 +1,43 @@
<div class="row">
<div class="form-group col-sm-6">
{!! Form::label('subfleet_id', 'Subfleet:') !!}
{!! Form::select('subfleet_id', $subfleets, null, ['class' => 'form-control select2', 'placeholder' => 'Select Subfleet']) !!}
{{ Form::label('subfleet_id', 'Subfleet:') }}
{{ Form::select('subfleet_id', $subfleets, null, ['class' => 'form-control select2', 'placeholder' => 'Select Subfleet']) }}
<p class="text-danger">{{ $errors->first('subfleet_id') }}</p>
</div>
<div class="form-group col-sm-6">
{!! Form::label('name', 'Name:') !!}&nbsp;<span class="required">*</span>
{!! Form::text('name', null, ['class' => 'form-control']) !!}
{{ Form::label('name', 'Name:') }}&nbsp;<span class="required">*</span>
{{ Form::text('name', null, ['class' => 'form-control']) }}
<p class="text-danger">{{ $errors->first('name') }}</p>
</div>
</div>
<div class="row">
<div class="form-group col-sm-6">
{!! Form::label('icao', 'ICAO:') !!}
{!! Form::text('icao', null, ['class' => 'form-control']) !!}
{{ Form::label('icao', 'ICAO:') }}
{{ Form::text('icao', null, ['class' => 'form-control']) }}
<p class="text-danger">{{ $errors->first('icao') }}</p>
</div>
<div class="form-group col-sm-6">
{!! Form::label('zfw', 'Zero Fuel Weight:') !!}
{!! Form::text('zfw', null, ['class' => 'form-control']) !!}
{{ Form::label('zfw', 'Zero Fuel Weight:') }}
{{ Form::text('zfw', null, ['class' => 'form-control']) }}
<p class="text-danger">{{ $errors->first('zfw') }}</p>
</div>
</div>
<div class="row">
<!-- Registration Field -->
<div class="form-group col-sm-6">
{!! Form::label('registration', 'Registration:') !!}
{{ Form::label('registration', 'Registration:') }}
{{--<p class="text-success small">Enter the registration with the country prefix</p>--}}
{!! Form::text('registration', null, ['class' => 'form-control']) !!}
{{ Form::text('registration', null, ['class' => 'form-control']) }}
<p class="text-danger">{{ $errors->first('registration') }}</p>
</div>
<!-- Active Field -->
<div class="form-group col-sm-6">
{!! Form::label('status', 'Status:') !!}
{!! Form::select('status', $statuses, null, ['class' => 'form-control select2', 'placeholder' => 'Select Status']) !!}
{{ Form::label('status', 'Status:') }}
{{ Form::select('status', $statuses, null, ['class' => 'form-control select2', 'placeholder' => 'Select Status']) }}
<p class="text-danger">{{ $errors->first('subfleet_id') }}</p>
</div>
</div>
@@ -45,8 +45,8 @@
<!-- Submit Field -->
<div class="form-group col-sm-12">
<div class="pull-right">
{!! Form::button('Save', ['type' => 'submit', 'class' => 'btn btn-success']) !!}
<a href="{!! route('admin.aircraft.index') !!}" class="btn btn-default">Cancel</a>
{{ Form::button('Save', ['type' => 'submit', 'class' => 'btn btn-success']) }}
<a href="{{ route('admin.aircraft.index') }}" class="btn btn-default">Cancel</a>
</div>
</div>
</div>
resources/views/admin/aircraft/index.blade.php
+2 -2
View File
@@ -3,12 +3,12 @@
@section('title', 'Aircraft')
@section('actions')
<li>
<a href="{!! url('/admin/subfleets') !!}">
<a href="{{ url('/admin/subfleets') }}">
<i class="ti-files"></i>
Subfleets</a>
</li>
<li>
<a href="{!! route('admin.aircraft.create') !!}">
<a href="{{ route('admin.aircraft.create') }}">
<i class="ti-plus"></i>
New Aircraft</a>
</li>
resources/views/admin/aircraft/script.blade.php
+3 -3
View File
@@ -4,7 +4,7 @@ function setEditable() {
@if(isset($aircraft))
$('#expenses a.text').editable({
emptytext: '0',
url: '{!! url('/admin/aircraft/'.$aircraft->id.'/expenses') !!}',
url: '{{ url('/admin/aircraft/'.$aircraft->id.'/expenses') }}',
title: 'Enter override value',
ajaxOptions: {'type': 'put'},
params: function (params) {
@@ -19,8 +19,8 @@ function setEditable() {
$('#expenses a.dropdown').editable({
type: 'select',
emptytext: '0',
source: {!! json_encode(list_to_editable(\App\Models\Enums\ExpenseType::select())) !!},
url: '{!! url('/admin/aircraft/'.$aircraft->id.'/expenses') !!}',
source: {{ json_encode(list_to_editable(\App\Models\Enums\ExpenseType::select())) }},
url: '{{ url('/admin/aircraft/'.$aircraft->id.'/expenses') }}',
title: 'Enter override value',
ajaxOptions: {'type': 'put'},
params: function (params) {
resources/views/admin/aircraft/show.blade.php
+3 -3
View File
@@ -2,9 +2,9 @@
@section('content')
<section class="content-header">
<h1 class="pull-left">{!! $aircraft->name !!}</h1>
<h1 class="pull-left">{{ $aircraft->name }}</h1>
<h1 class="pull-right">
<a class="btn btn-primary pull-right" style="margin-top: -10px;margin-bottom: 5px" href="{!! route('admin.aircraft.edit', $aircraft->id) !!}">Edit</a>
<a class="btn btn-primary pull-right" style="margin-top: -10px;margin-bottom: 5px" href="{{ route('admin.aircraft.edit', $aircraft->id) }}">Edit</a>
</h1>
</section>
<section class="content">
@@ -22,7 +22,7 @@ $(document).ready(function() {
type: 'text',
mode: 'inline',
emptytext: 'default',
url: '/admin/aircraft/{!! $aircraft->id !!}/fares',
url: '/admin/aircraft/{{ $aircraft->id }}/fares',
title: 'Enter override value',
ajaxOptions: { 'type': 'put'},
params: function(params) {
resources/views/admin/aircraft/show_fields.blade.php
+7 -7
View File
@@ -2,12 +2,12 @@
<div class="form-group col-sm-6">
<div class="box box-solid">
<div class="box-header with-border">
<h3 class="box-title">{!! Form::label('airport_id', 'Location') !!}</h3>
<h3 class="box-title">{{ Form::label('airport_id', 'Location') }}</h3>
</div>
<div class="box-body">
<p class="lead">
@if($aircraft->airport)
{!! $aircraft->airport->icao !!}</p>
{{ $aircraft->airport->icao }}</p>
@endif
</div>
</div>
@@ -18,9 +18,9 @@
<div class="box box-solid">
<div class="box-header with-border">
{{--<i class="fa fa-text-width"></i>--}}
<h3 class="box-title">{!! Form::label('name', 'Name') !!}</h3>
<h3 class="box-title">{{ Form::label('name', 'Name') }}</h3>
</div>
<div class="box-body"><p class="lead">{!! $aircraft->name !!}</p></div>
<div class="box-body"><p class="lead">{{ $aircraft->name }}</p></div>
</div>
</div>
@@ -29,9 +29,9 @@
<div class="box box-solid">
<div class="box-header with-border">
{{--<i class="fa fa-text-width"></i>--}}
<h3 class="box-title">{!! Form::label('registration', 'Registration') !!}</h3>
<h3 class="box-title">{{ Form::label('registration', 'Registration') }}</h3>
</div>
<div class="box-body"><p class="lead">{!! $aircraft->registration !!}</p></div>
<div class="box-body"><p class="lead">{{ $aircraft->registration }}</p></div>
</div>
</div>
@@ -40,7 +40,7 @@
<div class="box box-solid">
<div class="box-header with-border">
{{--<i class="fa fa-text-width"></i>--}}
<h3 class="box-title">{!! Form::label('active', 'Active:') !!}</h3>
<h3 class="box-title">{{ Form::label('active', 'Active:') }}</h3>
</div>
<div class="box-body"><p class="lead">@if ($aircraft->active == '1') yes @else no @endif</p></div>
</div>
resources/views/admin/aircraft/table.blade.php
+12 -12
View File
@@ -11,37 +11,37 @@
<tbody>
@foreach($aircraft as $ac)
<tr>
<td><a href="{!! route('admin.aircraft.edit', [$ac->id]) !!}">{!! $ac->name !!}</a></td>
<td style="text-align: center;">{!! $ac->registration !!}</td>
<td><a href="{{ route('admin.aircraft.edit', [$ac->id]) }}">{{ $ac->name }}</a></td>
<td style="text-align: center;">{{ $ac->registration }}</td>
<td>
@if($ac->subfleet_id && $ac->subfleet)
<a href="{!! route('admin.subfleets.edit', [$ac->subfleet_id]) !!}">
{!! $ac->subfleet->name !!}
<a href="{{ route('admin.subfleets.edit', [$ac->subfleet_id]) }}">
{{ $ac->subfleet->name }}
</a>
@else
-
@endif
</td>
<td style="text-align: center;">{!! $ac->airport_id !!}</td>
<td style="text-align: center;">{{ $ac->airport_id }}</td>
<td style="text-align: center;">
{!! Utils::minutesToTimeString($ac->flight_hours) !!}
{{ Utils::minutesToTimeString($ac->flight_hours) }}
</td>
<td style="text-align: center;">
@if($ac->status == \App\Models\Enums\AircraftStatus::ACTIVE)
<span class="label label-success">{!! \App\Models\Enums\AircraftStatus::label($ac->status); !!}</span>
<span class="label label-success">{{ \App\Models\Enums\AircraftStatus::label($ac->status) }}</span>
@else
<span class="label label-default">
{!! \App\Models\Enums\AircraftStatus::label($ac->status) !!}
{{ \App\Models\Enums\AircraftStatus::label($ac->status) }}
</span>
@endif
</td>
<td style="width: 10%; text-align: right;">
{!! Form::open(['route' => ['admin.aircraft.destroy', $ac->id], 'method' => 'delete']) !!}
<a href="{!! route('admin.aircraft.edit', [$ac->id]) !!}" class='btn btn-sm btn-success btn-icon'>
{{ Form::open(['route' => ['admin.aircraft.destroy', $ac->id], 'method' => 'delete']) }}
<a href="{{ route('admin.aircraft.edit', [$ac->id]) }}" class='btn btn-sm btn-success btn-icon'>
<i class="fas fa-pencil-alt"></i>
</a>
{!! Form::button('<i class="fa fa-times"></i>', ['type' => 'submit', 'class' => 'btn btn-sm btn-danger btn-icon', 'onclick' => "return confirm('Are you sure?')"]) !!}
{!! Form::close() !!}
{{ Form::button('<i class="fa fa-times"></i>', ['type' => 'submit', 'class' => 'btn btn-sm btn-danger btn-icon', 'onclick' => "return confirm('Are you sure?')"]) }}
{{ Form::close() }}
</td>
</tr>
@endforeach