FGFS-4.1/phpvms
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fixing XSS vulnerability by using the proper output tags

Browse Source
This commit is contained in:
Nabeel Shahzad
2018-03-12 17:58:12 -05:00
parent 17f9464208
commit 8076c2d8c1
165 changed files with 1187 additions and 1187 deletions
Download Patch File Download Diff File Expand all files Collapse all files
resources/views/admin/airports/create.blade.php
+2 -2
View File
@@ -4,9 +4,9 @@
@section('content')
<div class="card border-blue-bottom">
<div class="content">
{!! Form::open(['route' => 'admin.airports.store', 'id' => 'airportForm']) !!}
{{ Form::open(['route' => 'admin.airports.store', 'id' => 'airportForm']) }}
@include('admin.airports.fields')
{!! Form::close() !!}
{{ Form::close() }}
</div>
</div>
@endsection
resources/views/admin/airports/edit.blade.php
+3 -3
View File
@@ -3,13 +3,13 @@
@section('content')
<div class="card border-blue-bottom">
<div class="content">
{!! Form::model($airport, [
{{ Form::model($airport, [
'route' => ['admin.airports.update', $airport->id],
'method' => 'patch',
'id' => 'airportForm'])
!!}
}}
@include('admin.airports.fields')
{!! Form::close() !!}
{{ Form::close() }}
</div>
</div>
resources/views/admin/airports/expenses.blade.php
+21 -21
View File
@@ -11,7 +11,7 @@
@if(count($airport->expenses))
<thead>
<th>Name</th>
<th>Cost&nbsp;<span class="small">{!! currency(config('phpvms.currency')) !!}</span></th>
<th>Cost&nbsp;<span class="small">{{ currency(config('phpvms.currency')) }}</span></th>
<th>Type</th>
<th></th>
</thead>
@@ -22,33 +22,33 @@
<tr>
<td>
<p>
<a class="text" href="#" data-pk="{!! $expense->id !!}"
data-name="name">{!! $expense->name !!}</a>
<a class="text" href="#" data-pk="{{ $expense->id }}"
data-name="name">{{ $expense->name }}</a>
</p>
</td>
<td>
<p>
<a class="text" href="#" data-pk="{!! $expense->id !!}"
data-name="amount">{!! $expense->amount !!}</a>
<a class="text" href="#" data-pk="{{ $expense->id }}"
data-name="amount">{{ $expense->amount }}</a>
</p>
</td>
<td>
<p>
<a href="#"
class="dropdown"
data-pk="{!! $expense->id !!}"
data-name="type">{!! \App\Models\Enums\ExpenseType::label($expense->type) !!}</a>
data-pk="{{ $expense->id }}"
data-name="type">{{ \App\Models\Enums\ExpenseType::label($expense->type) }}</a>
</p>
</td>
<td align="right">
{!! Form::open(['url' => url('/admin/airports/'.$airport->id.'/expenses'),
'method' => 'delete', 'class' => 'modify_expense form-inline']) !!}
{!! Form::hidden('expense_id', $expense->id) !!}
{!! Form::button('<i class="fa fa-times"></i>', ['type' => 'submit',
{{ Form::open(['url' => url('/admin/airports/'.$airport->id.'/expenses'),
'method' => 'delete', 'class' => 'modify_expense form-inline']) }}
{{ Form::hidden('expense_id', $expense->id) }}
{{ Form::button('<i class="fa fa-times"></i>', ['type' => 'submit',
'class' => 'btn btn-sm btn-danger btn-icon',
'onclick' => "return confirm('Are you sure?')",
]) !!}
{!! Form::close() !!}
]) }}
{{ Form::close() }}
</td>
</tr>
@endforeach
@@ -58,14 +58,14 @@
<div class="row">
<div class="col-sm-12">
<div class="text-right">
{!! Form::open(['url' => url('/admin/airports/'.$airport->id.'/expenses'),
'method' => 'post', 'class' => 'modify_expense form-inline']) !!}
{!! Form::input('text', 'name', null, ['class' => 'form-control input-sm', 'placeholder' => 'Name']) !!}
{!! Form::number('amount', null, ['class' => 'form-control input-sm', 'placeholder' => 'Amount']) !!}
{!! Form::select('type', \App\Models\Enums\ExpenseType::select(), null, ['class' => 'select2']) !!}
{!! Form::button('<i class="fa fa-plus"></i> Add', ['type' => 'submit',
'class' => 'btn btn-success btn-small']) !!}
{!! Form::close() !!}
{{ Form::open(['url' => url('/admin/airports/'.$airport->id.'/expenses'),
'method' => 'post', 'class' => 'modify_expense form-inline']) }}
{{ Form::input('text', 'name', null, ['class' => 'form-control input-sm', 'placeholder' => 'Name']) }}
{{ Form::number('amount', null, ['class' => 'form-control input-sm', 'placeholder' => 'Amount']) }}
{{ Form::select('type', \App\Models\Enums\ExpenseType::select(), null, ['class' => 'select2']) }}
{{ Form::button('<i class="fa fa-plus"></i> Add', ['type' => 'submit',
'class' => 'btn btn-success btn-small']) }}
{{ Form::close() }}
<p class="text-danger">{{ $errors->first('name') }}</p>
<p class="text-danger">{{ $errors->first('amount') }}</p>
resources/views/admin/airports/fields.blade.php
+24 -24
View File
@@ -3,17 +3,17 @@
<!-- Icao Field -->
<div class="row">
<div class="form-group col-sm-6">
{!! Form::label('icao', 'ICAO:') !!}&nbsp;<span class="required">*</span>
{{ Form::label('icao', 'ICAO:') }}&nbsp;<span class="required">*</span>
<a href="#" class="airport_data_lookup">Lookup</a>
{!! Form::text('icao', null, [
{{ Form::text('icao', null, [
'id' => 'airport_icao', 'class' => 'form-control'
]) !!}
]) }}
<p class="text-danger">{{ $errors->first('icao') }}</p>
</div>
<div class="form-group col-sm-6">
{!! Form::label('iata', 'IATA:') !!}
{!! Form::text('iata', null, ['class' => 'form-control']) !!}
{{ Form::label('iata', 'IATA:') }}
{{ Form::text('iata', null, ['class' => 'form-control']) }}
<p class="text-danger">{{ $errors->first('iata') }}</p>
</div>
@@ -21,19 +21,19 @@
<div class="row">
<div class="form-group col-sm-4">
{!! Form::label('name', 'Name:') !!}&nbsp;<span class="required">*</span>
{!! Form::text('name', null, ['class' => 'form-control']) !!}
{{ Form::label('name', 'Name:') }}&nbsp;<span class="required">*</span>
{{ Form::text('name', null, ['class' => 'form-control']) }}
<p class="text-danger">{{ $errors->first('name') }}</p>
</div>
<div class="form-group col-sm-4">
{!! Form::label('lat', 'Latitude:') !!}&nbsp;<span class="required">*</span>
{!! Form::number('lat', null, ['class' => 'form-control', 'step' => '0.000001', 'rv-value' => 'airport.lat']) !!}
{{ Form::label('lat', 'Latitude:') }}&nbsp;<span class="required">*</span>
{{ Form::number('lat', null, ['class' => 'form-control', 'step' => '0.000001', 'rv-value' => 'airport.lat']) }}
<p class="text-danger">{{ $errors->first('lat') }}</p>
</div>
<div class="form-group col-sm-4">
{!! Form::label('lon', 'Longitude:') !!}&nbsp;<span class="required">*</span>
{!! Form::number('lon', null, ['class' => 'form-control', 'step' => '0.000001', 'rv-value' => 'airport.lon']) !!}
{{ Form::label('lon', 'Longitude:') }}&nbsp;<span class="required">*</span>
{{ Form::number('lon', null, ['class' => 'form-control', 'step' => '0.000001', 'rv-value' => 'airport.lon']) }}
<p class="text-danger">{{ $errors->first('lon') }}</p>
</div>
</div>
@@ -41,28 +41,28 @@
<div class="row">
<div class="form-group col-sm-4">
{!! Form::label('country', 'Country:') !!}
{!! Form::text('country', null, ['class' => 'form-control']) !!}
{{ Form::label('country', 'Country:') }}
{{ Form::text('country', null, ['class' => 'form-control']) }}
<p class="text-danger">{{ $errors->first('country') }}</p>
</div>
<div class="form-group col-sm-4">
{!! Form::label('location', 'Location:') !!}
{!! Form::text('location', null, ['class' => 'form-control']) !!}
{{ Form::label('location', 'Location:') }}
{{ Form::text('location', null, ['class' => 'form-control']) }}
<p class="text-danger">{{ $errors->first('location') }}</p>
</div>
<div class="form-group col-sm-4">
{!! Form::label('timezone', 'Timezone:') !!}
{!! Form::select('timezone', $timezones, null, ['id' => 'timezone', 'class' => 'select2']); !!}
{{ Form::label('timezone', 'Timezone:') }}
{{ Form::select('timezone', $timezones, null, ['id' => 'timezone', 'class' => 'select2']) }}
<p class="text-danger">{{ $errors->first('timezone') }}</p>
</div>
</div>
<div class="row">
<div class="form-group col-sm-6">
{!! Form::label('ground_handling_cost', 'Ground Handling Cost:') !!}
{!! Form::number('ground_handling_cost', null, ['class' => 'form-control']) !!}
{{ Form::label('ground_handling_cost', 'Ground Handling Cost:') }}
{{ Form::number('ground_handling_cost', null, ['class' => 'form-control']) }}
<p class="text-danger">{{ $errors->first('ground_handling_cost') }}</p>
@component('admin.components.info')
@@ -79,15 +79,15 @@
<div class="row">
<div class="form-group col-sm-4">
{!! Form::label('hub', 'Hub:') !!}
{!! Form::hidden('hub', 0) !!}
{!! Form::checkbox('hub', null) !!}
{{ Form::label('hub', 'Hub:') }}
{{ Form::hidden('hub', 0) }}
{{ Form::checkbox('hub', null) }}
</div>
<!-- Submit Field -->
<div class="form-group col-sm-8">
<div class="text-right">
{!! Form::button('Save', ['type' => 'submit', 'class' => 'btn btn-success']) !!}
<a href="{!! route('admin.airports.index') !!}" class="btn btn-default">Cancel</a>
{{ Form::button('Save', ['type' => 'submit', 'class' => 'btn btn-success']) }}
<a href="{{ route('admin.airports.index') }}" class="btn btn-default">Cancel</a>
</div>
</div>
</div>
resources/views/admin/airports/index.blade.php
+1 -1
View File
@@ -3,7 +3,7 @@
@section('title', 'Airports')
@section('actions')
<li>
<a href="{!! route('admin.airports.create') !!}">
<a href="{{ route('admin.airports.create') }}">
<i class="ti-plus"></i>
Add New</a>
</li>
resources/views/admin/airports/script.blade.php
+4 -4
View File
@@ -4,7 +4,7 @@ function setEditable() {
@if(isset($airport))
$('#airport-expenses a.text').editable({
emptytext: '0',
url: '{!! url('/admin/airports/'.$airport->id.'/expenses') !!}',
url: '{{ url('/admin/airports/'.$airport->id.'/expenses') }}',
title: 'Enter override value',
ajaxOptions: {'type': 'put'},
params: function (params) {
@@ -19,8 +19,8 @@ function setEditable() {
$('#airport-expenses a.dropdown').editable({
type: 'select',
emptytext: '0',
source: {!! json_encode(list_to_editable(\App\Models\Enums\ExpenseType::select())) !!},
url: '{!! url('/admin/airports/'.$airport->id.'/expenses') !!}',
source: {{ json_encode(list_to_editable(\App\Models\Enums\ExpenseType::select())) }},
url: '{{ url('/admin/airports/'.$airport->id.'/expenses') }}',
title: 'Enter override value',
ajaxOptions: {'type': 'put'},
params: function (params) {
@@ -54,7 +54,7 @@ $(document).ready(function() {
type: 'text',
mode: 'inline',
emptytext: '0',
url: '{!! url('/admin/airports/fuel') !!}',
url: '{{ url('/admin/airports/fuel') }}',
title: 'Enter price per unit of fuel',
ajaxOptions: {'type': 'put'},
params: function(params) {
resources/views/admin/airports/search.blade.php
+5 -5
View File
@@ -2,13 +2,13 @@
<div class="row">
<div class="col-sm-12">
<div class="form-group">
{!! Form::open(['route' => 'admin.airports.index', 'method' => 'GET', 'class'=>'form-inline pull-right']) !!}
{{ Form::open(['route' => 'admin.airports.index', 'method' => 'GET', 'class'=>'form-inline pull-right']) }}
{!! Form::label('icao', 'ICAO:') !!}
{!! Form::text('icao', null, ['class' => 'form-control']) !!}
{{ Form::label('icao', 'ICAO:') }}
{{ Form::text('icao', null, ['class' => 'form-control']) }}
&nbsp;
<a href="{!! route('admin.airports.index') !!}">clear</a>
{!! Form::close() !!}
<a href="{{ route('admin.airports.index') }}">clear</a>
{{ Form::close() }}
</div>
</div>
</div>
resources/views/admin/airports/show.blade.php
+6 -6
View File
@@ -2,10 +2,10 @@
@section('content')
<section class="content-header">
<h1 class="pull-left">{!! $airport->name !!} - {!! $airport->location !!}</h1>
<h1 class="pull-left">{{ $airport->name }} - {{ $airport->location }}</h1>
<h1 class="pull-right">
<a class="btn btn-primary pull-right" style="margin-top: -10px;margin-bottom: 5px" href="{!! route('admin.airports.edit', $airport->id) !!}">Edit</a>
</h1>
<a class="btn btn-primary pull-right" style="margin-top: -10px;margin-bottom: 5px" href="{{ route('admin.airports.edit', $airport->id) }}">Edit</a>
</h1>
</section>
<section class="content">
<div class="clearfix"></div>
@@ -26,10 +26,10 @@
</section>
@endsection
@section('scripts')
<script type="text/javascript">
<script type="text/javascript">
phpvms_render_airspace_map({
lat: {!! $airport->lat !!},
lon: {!! $airport->lon !!},
lat: {{ $airport->lat }},
lon: {{ $airport->lon }},
});
</script>
@endsection
resources/views/admin/airports/show_fields.blade.php
+2 -2
View File
@@ -5,7 +5,7 @@
<h3 class="box-title">ICAO</h3>
</div>
<div class="box-body">
<p class="lead">{!! $airport->icao !!}<strong></p>
<p class="lead">{{ $airport->icao }}<strong></p>
</div>
</div>
</div>
@@ -16,7 +16,7 @@
<h3 class="box-title">Coordinates</h3>
</div>
<div class="box-body">
<p class="lead">{!! $airport->lat!!}/{!! $airport->lon !!}</p>
<p class="lead">{{ $airport->lat}}/{{ $airport->lon }}</p>
</div>
</div>
</div>
resources/views/admin/airports/table.blade.php
+11 -11
View File
@@ -14,31 +14,31 @@
<tbody>
@foreach($airports as $airport)
<tr>
<td><a href="{!! route('admin.airports.edit', [$airport->id]) !!}">{!! $airport->icao !!}</a></td>
<td>{!! $airport->name !!}</td>
<td>{!! $airport->location !!}</td>
<td><a href="{{ route('admin.airports.edit', [$airport->id]) }}">{{ $airport->icao }}</a></td>
<td>{{ $airport->name }}</td>
<td>{{ $airport->location }}</td>
<td style="text-align: center;">
@if($airport->hub === true)
<span class="label label-success">Hub</span>
@endif
</td>
<td style="text-align: center;">
{!! $airport->ground_handling_cost !!}
{{ $airport->ground_handling_cost }}
</td>
<td style="text-align: center;">
<a class="inline" href="#" data-pk="{!! $airport->id !!}" data-name="fuel_100ll_cost">{!! $airport->fuel_100ll_cost !!}</a>
<a class="inline" href="#" data-pk="{{ $airport->id }}" data-name="fuel_100ll_cost">{{ $airport->fuel_100ll_cost }}</a>
</td>
<td style="text-align: center;">
<a class="inline" href="#" data-pk="{!! $airport->id !!}" data-name="fuel_jeta_cost">{!! $airport->fuel_jeta_cost !!}</a>
<a class="inline" href="#" data-pk="{{ $airport->id }}" data-name="fuel_jeta_cost">{{ $airport->fuel_jeta_cost }}</a>
</td>
<td style="text-align: center;">
<a class="inline" href="#" data-pk="{!! $airport->id !!}" data-name="fuel_mogas_cost">{!! $airport->fuel_mogas_cost !!}</a>
<a class="inline" href="#" data-pk="{{ $airport->id }}" data-name="fuel_mogas_cost">{{ $airport->fuel_mogas_cost }}</a>
</td>
<td style="text-align: right;">
{!! Form::open(['route' => ['admin.airports.destroy', $airport->id], 'method' => 'delete']) !!}
<a href="{!! route('admin.airports.edit', [$airport->id]) !!}" class='btn btn-sm btn-success btn-icon'><i class="fas fa-pencil-alt"></i></a>
{!! Form::button('<i class="fa fa-times"></i>', ['type' => 'submit', 'class' => 'btn btn-sm btn-danger btn-icon', 'onclick' => "return confirm('Are you sure?')"]) !!}
{!! Form::close() !!}
{{ Form::open(['route' => ['admin.airports.destroy', $airport->id], 'method' => 'delete']) }}
<a href="{{ route('admin.airports.edit', [$airport->id]) }}" class='btn btn-sm btn-success btn-icon'><i class="fas fa-pencil-alt"></i></a>
{{ Form::button('<i class="fa fa-times"></i>', ['type' => 'submit', 'class' => 'btn btn-sm btn-danger btn-icon', 'onclick' => "return confirm('Are you sure?')"]) }}
{{ Form::close() }}
</td>
</tr>
@endforeach