FGFS-4.1/phpvms
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fixing XSS vulnerability by using the proper output tags

Browse Source
This commit is contained in:
Nabeel Shahzad
2018-03-12 17:58:12 -05:00
parent 17f9464208
commit 8076c2d8c1
165 changed files with 1187 additions and 1187 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
resources/views/admin/pireps/comments.blade.php
View File

@@ -9,23 +9,23 @@
@foreach($pirep->comments as $comment)
<tr>
<td width="1%" nowrap="" style="vertical-align: text-top">
<a href="{!! route('admin.users.show', [$comment->user_id]) !!}">
{!! $comment->user->name !!}
<a href="{{ route('admin.users.show', [$comment->user_id]) }}">
{{ $comment->user->name }}
</a>
</td>
<td>
<p>{!! $comment->comment !!}</p>
<p class="small">{!! show_datetime($comment->created_at) !!}</p>
<p>{{ $comment->comment }}</p>
<p class="small">{{ show_datetime($comment->created_at) }}</p>
</td>
<td align="right">
{!! Form::open(['url' => url('/admin/pireps/'.$pirep->id.'/comments'),
'method' => 'delete', 'class' => 'pjax_form form-inline']) !!}
{!! Form::hidden('comment_id', $comment->id) !!}
{!! Form::button('<i class="fa fa-times"></i>', ['type' => 'submit',
{{ Form::open(['url' => url('/admin/pireps/'.$pirep->id.'/comments'),
'method' => 'delete', 'class' => 'pjax_form form-inline']) }}
{{ Form::hidden('comment_id', $comment->id) }}
{{ Form::button('<i class="fa fa-times"></i>', ['type' => 'submit',
'class' => 'btn btn-danger btn-small',
'onclick' => "return confirm('Are you sure?')",
]) !!}
{!! Form::close() !!}
]) }}
{{ Form::close() }}
</td>
</tr>
@endforeach
@@ -35,12 +35,12 @@
<div class="row">
<div class="col-sm-12">
<div class="text-right">
{!! Form::open(['url' => url('/admin/pireps/'.$pirep->id.'/comments'),
'method' => 'post', 'class' => 'pjax_form form-inline']) !!}
{!! Form::input('text', 'comment', null, ['class' => 'form-control input-sm']) !!}
{!! Form::button('<i class="fa fa-plus"></i> Add', ['type' => 'submit',
'class' => 'btn btn-success btn-small']) !!}
{!! Form::close() !!}
{{ Form::open(['url' => url('/admin/pireps/'.$pirep->id.'/comments'),
'method' => 'post', 'class' => 'pjax_form form-inline']) }}
{{ Form::input('text', 'comment', null, ['class' => 'form-control input-sm']) }}
{{ Form::button('<i class="fa fa-plus"></i> Add', ['type' => 'submit',
'class' => 'btn btn-success btn-small']) }}
{{ Form::close() }}
</div>
</div>
</div>