FGFS-4.1/phpvms
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fixing XSS vulnerability by using the proper output tags

Browse Source
This commit is contained in:
Nabeel Shahzad
2018-03-12 17:58:12 -05:00
parent 17f9464208
commit 8076c2d8c1
165 changed files with 1187 additions and 1187 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
resources/views/admin/subfleets/create.blade.php
View File

@@ -8,9 +8,9 @@
You must add an airline before you can add a subfleet!
</p>
@else
{!! Form::open(['route' => 'admin.subfleets.store']) !!}
{{ Form::open(['route' => 'admin.subfleets.store']) }}
@include('admin.subfleets.fields')
{!! Form::close() !!}
{{ Form::close() }}
@endif
</div>
</div>

4
resources/views/admin/subfleets/edit.blade.php
View File

@@ -4,9 +4,9 @@
@section('content')
<div class="card border-blue-bottom">
<div class="content">
{!! Form::model($subfleet, ['route' => ['admin.subfleets.update', $subfleet->id], 'method' => 'patch']) !!}
{{ Form::model($subfleet, ['route' => ['admin.subfleets.update', $subfleet->id], 'method' => 'patch']) }}
@include('admin.subfleets.fields')
{!! Form::close() !!}
{{ Form::close() }}
</div>
</div>

42
resources/views/admin/subfleets/expenses.blade.php
View File

@@ -10,7 +10,7 @@
@if(count($subfleet->expenses))
<thead>
<th>Name</th>
<th>Cost&nbsp;<span class="small">{!! currency(config('phpvms.currency')) !!}</span></th>
<th>Cost&nbsp;<span class="small">{{ currency(config('phpvms.currency')) }}</span></th>
<th>Type</th>
<th></th>
</thead>
@@ -20,33 +20,33 @@
<tr>
<td>
<p>
<a class="text" href="#" data-pk="{!! $expense->id !!}"
data-name="name">{!! $expense->name !!}</a>
<a class="text" href="#" data-pk="{{ $expense->id }}"
data-name="name">{{ $expense->name }}</a>
</p>
</td>
<td>
<p>
<a class="text" href="#" data-pk="{!! $expense->id !!}"
data-name="amount">{!! $expense->amount !!}</a>
<a class="text" href="#" data-pk="{{ $expense->id }}"
data-name="amount">{{ $expense->amount }}</a>
</p>
</td>
<td>
<p>
<a href="#"
class="dropdown"
data-pk="{!! $expense->id !!}"
data-name="type">{!! \App\Models\Enums\ExpenseType::label($expense->type) !!}</a>
data-pk="{{ $expense->id }}"
data-name="type">{{ \App\Models\Enums\ExpenseType::label($expense->type) }}</a>
</p>
</td>
<td align="right">
{!! Form::open(['url' => url('/admin/subfleets/'.$subfleet->id.'/expenses'),
'method' => 'delete', 'class' => 'modify_expense form-inline']) !!}
{!! Form::hidden('expense_id', $expense->id) !!}
{!! Form::button('<i class="fa fa-times"></i>', ['type' => 'submit',
{{ Form::open(['url' => url('/admin/subfleets/'.$subfleet->id.'/expenses'),
'method' => 'delete', 'class' => 'modify_expense form-inline']) }}
{{ Form::hidden('expense_id', $expense->id) }}
{{ Form::button('<i class="fa fa-times"></i>', ['type' => 'submit',
'class' => 'btn btn-sm btn-danger btn-icon',
'onclick' => "return confirm('Are you sure?')",
]) !!}
{!! Form::close() !!}
]) }}
{{ Form::close() }}
</td>
</tr>
@endforeach
@@ -56,14 +56,14 @@
<div class="row">
<div class="col-sm-12">
<div class="text-right">
{!! Form::open(['url' => url('/admin/subfleets/'.$subfleet->id.'/expenses'),
'method' => 'post', 'class' => 'modify_expense form-inline']) !!}
{!! Form::text('name', null, ['class' => 'form-control input-sm', 'placeholder' => 'Name']) !!}
{!! Form::number('amount', null, ['class' => 'form-control input-sm', 'placeholder' => 'Amount']) !!}
{!! Form::select('type', \App\Models\Enums\ExpenseType::select(), null, ['class' => 'select2']) !!}
{!! Form::button('<i class="fa fa-plus"></i> Add', ['type' => 'submit',
'class' => 'btn btn-success btn-small']) !!}
{!! Form::close() !!}
{{ Form::open(['url' => url('/admin/subfleets/'.$subfleet->id.'/expenses'),
'method' => 'post', 'class' => 'modify_expense form-inline']) }}
{{ Form::text('name', null, ['class' => 'form-control input-sm', 'placeholder' => 'Name']) }}
{{ Form::number('amount', null, ['class' => 'form-control input-sm', 'placeholder' => 'Amount']) }}
{{ Form::select('type', \App\Models\Enums\ExpenseType::select(), null, ['class' => 'select2']) }}
{{ Form::button('<i class="fa fa-plus"></i> Add', ['type' => 'submit',
'class' => 'btn btn-success btn-small']) }}
{{ Form::close() }}
<p class="text-danger">{{ $errors->first('name') }}</p>
<p class="text-danger">{{ $errors->first('amount') }}</p>

42
resources/views/admin/subfleets/fares.blade.php
View File

@@ -24,29 +24,29 @@
<tbody>
@foreach($subfleet->fares as $atf)
<tr>
<td class="sorting_1">{!! $atf->name !!}</td>
<td style="text-align: center;">{!! $atf->code !!}</td>
<td class="sorting_1">{{ $atf->name }}</td>
<td style="text-align: center;">{{ $atf->code }}</td>
<td style="text-align: center;">
<a href="#" data-pk="{!! $atf->id !!}" data-name="capacity">{!! $atf->pivot->capacity !!}</a>
<span class="small background-color-grey-light">({!! $atf->capacity !!})</span>
<a href="#" data-pk="{{ $atf->id }}" data-name="capacity">{{ $atf->pivot->capacity }}</a>
<span class="small background-color-grey-light">({{ $atf->capacity }})</span>
</td>
<td style="text-align: center;">
<a href="#" data-pk="{!! $atf->id !!}" data-name="price">{!! $atf->pivot->price !!}</a>
<span class="small background-color-grey-light">({!! $atf->price !!})</span></td>
<a href="#" data-pk="{{ $atf->id }}" data-name="price">{{ $atf->pivot->price }}</a>
<span class="small background-color-grey-light">({{ $atf->price }})</span></td>
<td style="text-align: center;">
<a href="#" data-pk="{!! $atf->id !!}" data-name="cost">{!! $atf->pivot->cost !!}</a>
<span class="small background-color-grey-light">({!! $atf->cost!!})</span></td>
<a href="#" data-pk="{{ $atf->id }}" data-name="cost">{{ $atf->pivot->cost }}</a>
<span class="small background-color-grey-light">({{ $atf->cost}})</span></td>
<td style="text-align: right; width:3%;">
{!! Form::open(['url' => '/admin/subfleets/'.$subfleet->id.'/fares',
{{ Form::open(['url' => '/admin/subfleets/'.$subfleet->id.'/fares',
'method' => 'delete',
'class' => 'rm_fare'
])
!!}
{!! Form::hidden('fare_id', $atf->id) !!}
{!! Form::button('<i class="fa fa-times"></i>',
}}
{{ Form::hidden('fare_id', $atf->id) }}
{{ Form::button('<i class="fa fa-times"></i>',
['type' => 'submit',
'class' => 'btn btn-sm btn-danger btn-icon']) !!}
{!! Form::close() !!}
'class' => 'btn btn-sm btn-danger btn-icon']) }}
{{ Form::close() }}
</td>
</tr>
@endforeach
@@ -56,20 +56,20 @@
<div class="row">
<div class="col-xs-12">
<div class="text-right">
{!! Form::open(['url' => '/admin/subfleets/'.$subfleet->id.'/fares',
{{ Form::open(['url' => '/admin/subfleets/'.$subfleet->id.'/fares',
'method' => 'post',
'class' => 'rm_fare form-inline'
])
!!}
{!! Form::select('fare_id', $avail_fares, null, [
}}
{{ Form::select('fare_id', $avail_fares, null, [
'placeholder' => 'Select Fare',
'class' => 'ac-fare-dropdown form-control input-lg select2',
])
!!}
{!! Form::button('<i class="glyphicon glyphicon-plus"></i> add',
}}
{{ Form::button('<i class="glyphicon glyphicon-plus"></i> add',
['type' => 'submit',
'class' => 'btn btn-success btn-s']) !!}
{!! Form::close() !!}
'class' => 'btn btn-success btn-s']) }}
{{ Form::close() }}
</div>
</div>
</div>

24
resources/views/admin/subfleets/fields.blade.php
View File

@@ -1,34 +1,34 @@
<div class="row">
<div class="form-group col-sm-6">
{!! Form::label('name', 'Name:') !!}
{!! Form::text('name', null, ['class' => 'form-control']) !!}
{{ Form::label('name', 'Name:') }}
{{ Form::text('name', null, ['class' => 'form-control']) }}
<p class="text-danger">{{ $errors->first('name') }}</p>
</div>
<div class="form-group col-sm-6">
{!! Form::label('type', 'Type:') !!}
{!! Form::text('type', null, ['class' => 'form-control']) !!}
{{ Form::label('type', 'Type:') }}
{{ Form::text('type', null, ['class' => 'form-control']) }}
<p class="text-danger">{{ $errors->first('type') }}</p>
</div>
</div>
<div class="row">
<div class="form-group col-sm-4">
{!! Form::label('airline_id', 'Airline:') !!}
{!! Form::select('airline_id', $airlines, null , ['class' => 'form-control select2']) !!}
{{ Form::label('airline_id', 'Airline:') }}
{{ Form::select('airline_id', $airlines, null , ['class' => 'form-control select2']) }}
<p class="text-danger">{{ $errors->first('airline_id') }}</p>
</div>
<div class="form-group col-sm-4">
{!! Form::label('fuel_type', 'Fuel Type:') !!}
{!! Form::select('fuel_type', $fuel_types, null , ['class' => 'form-control select2']) !!}
{{ Form::label('fuel_type', 'Fuel Type:') }}
{{ Form::select('fuel_type', $fuel_types, null , ['class' => 'form-control select2']) }}
<p class="text-danger">{{ $errors->first('fuel_type') }}</p>
</div>
<div class="form-group col-sm-4">
{!! Form::label('ground_handling_multiplier', 'Ground Handling Multiplier:') !!}
{!! Form::text('ground_handling_multiplier', null, ['class' => 'form-control']) !!}
{{ Form::label('ground_handling_multiplier', 'Ground Handling Multiplier:') }}
{{ Form::text('ground_handling_multiplier', null, ['class' => 'form-control']) }}
<p class="text-danger">{{ $errors->first('ground_handling_multiplier') }}</p>
@component('admin.components.info')
@@ -41,8 +41,8 @@
<div class="form-group col-sm-12">
<div class="pull-right">
{!! Form::button('Save', ['type' => 'submit', 'class' => 'btn btn-success']) !!}
<a href="{!! route('admin.subfleets.index') !!}" class="btn btn-default">Cancel</a>
{{ Form::button('Save', ['type' => 'submit', 'class' => 'btn btn-success']) }}
<a href="{{ route('admin.subfleets.index') }}" class="btn btn-default">Cancel</a>
</div>
</div>
</div>

2
resources/views/admin/subfleets/index.blade.php
View File

@@ -3,7 +3,7 @@
@section('actions')
<li>
<a href="{!! route('admin.subfleets.create') !!}">
<a href="{{ route('admin.subfleets.create') }}">
<i class="ti-plus"></i>Add New</a>
</li>
@endsection

38
resources/views/admin/subfleets/ranks.blade.php
View File

@@ -22,28 +22,28 @@
<tbody>
@foreach($subfleet->ranks as $rank)
<tr>
<td class="sorting_1">{!! $rank->name !!}</td>
<td style="text-align: center;">{!! $rank->base_pay_rate ?: '-' !!}</td>
<td class="sorting_1">{{ $rank->name }}</td>
<td style="text-align: center;">{{ $rank->base_pay_rate ?: '-' }}</td>
<td style="text-align: center;">
<a href="#" data-pk="{!! $rank->id !!}"
data-name="acars_pay">{!! $rank->pivot->acars_pay !!}</a>
<a href="#" data-pk="{{ $rank->id }}"
data-name="acars_pay">{{ $rank->pivot->acars_pay }}</a>
</td>
<td style="text-align: center;">
<a href="#" data-pk="{!! $rank->id !!}"
data-name="manual_pay">{!! $rank->pivot->manual_pay !!}</a>
<a href="#" data-pk="{{ $rank->id }}"
data-name="manual_pay">{{ $rank->pivot->manual_pay }}</a>
</td>
<td style="text-align: right; width:3%;">
{!! Form::open(['url' => '/admin/subfleets/'.$subfleet->id.'/ranks',
{{ Form::open(['url' => '/admin/subfleets/'.$subfleet->id.'/ranks',
'method' => 'delete',
'class' => 'modify_rank'])
!!}
{!! Form::hidden('rank_id', $rank->id) !!}
{!! Form::button('<i class="fa fa-times"></i>',
}}
{{ Form::hidden('rank_id', $rank->id) }}
{{ Form::button('<i class="fa fa-times"></i>',
['type' => 'submit',
'class' => 'btn btn-sm btn-danger btn-icon']) !!}
{!! Form::close() !!}
'class' => 'btn btn-sm btn-danger btn-icon']) }}
{{ Form::close() }}
</td>
</tr>
@endforeach
@@ -53,20 +53,20 @@
<div class="row">
<div class="col-xs-12">
<div class="text-right">
{!! Form::open(['url' => '/admin/subfleets/'.$subfleet->id.'/ranks',
{{ Form::open(['url' => '/admin/subfleets/'.$subfleet->id.'/ranks',
'method' => 'post',
'class' => 'modify_rank form-inline'])
!!}
{!! Form::select('rank_id', $avail_ranks, null, [
}}
{{ Form::select('rank_id', $avail_ranks, null, [
'placeholder' => 'Select Rank',
'class' => 'ac-fare-dropdown form-control input-lg select2',
])
!!}
{!! Form::button('<i class="glyphicon glyphicon-plus"></i> add',
}}
{{ Form::button('<i class="glyphicon glyphicon-plus"></i> add',
['type' => 'submit',
'class' => 'btn btn-success btn-s']) !!}
{!! Form::close() !!}
'class' => 'btn btn-success btn-s']) }}
{{ Form::close() }}
</div>
</div>
</div>

10
resources/views/admin/subfleets/script.blade.php
View File

@@ -5,7 +5,7 @@ function setEditable() {
type: 'text',
mode: 'inline',
emptytext: 'inherited',
url: '{!! url('/admin/subfleets/'.$subfleet->id.'/fares') !!}',
url: '{{ url('/admin/subfleets/'.$subfleet->id.'/fares') }}',
title: 'Enter override value',
ajaxOptions: {'type': 'put'},
params: function (params) {
@@ -21,7 +21,7 @@ function setEditable() {
type: 'text',
mode: 'inline',
emptytext: 'inherited',
url: '{!! url('/admin/subfleets/'.$subfleet->id.'/ranks') !!}',
url: '{{ url('/admin/subfleets/'.$subfleet->id.'/ranks') }}',
title: 'Enter override value',
ajaxOptions: {'type': 'put'},
params: function (params) {
@@ -35,7 +35,7 @@ function setEditable() {
$('#subfleet-expenses a.text').editable({
emptytext: '0',
url: '{!! url('/admin/subfleets/'.$subfleet->id.'/expenses') !!}',
url: '{{ url('/admin/subfleets/'.$subfleet->id.'/expenses') }}',
title: 'Enter override value',
ajaxOptions: {'type': 'put'},
params: function (params) {
@@ -50,8 +50,8 @@ function setEditable() {
$('#subfleet-expenses a.dropdown').editable({
type: 'select',
emptytext: '0',
source: {!! json_encode(list_to_editable(\App\Models\Enums\ExpenseType::select())) !!},
url: '{!! url('/admin/subfleets/'.$subfleet->id.'/expenses') !!}',
source: {{ json_encode(list_to_editable(\App\Models\Enums\ExpenseType::select())) }},
url: '{{ url('/admin/subfleets/'.$subfleet->id.'/expenses') }}',
title: 'Enter override value',
ajaxOptions: {'type': 'put'},
params: function (params) {

20
resources/views/admin/subfleets/show_fields.blade.php
View File

@@ -1,31 +1,31 @@
<!-- Id Field -->
<!-- Airline Id Field -->
<div class="form-group">
{!! Form::label('airline_id', 'Airline Id:') !!}
<p>{!! $subfleet->airline->name !!}</p>
{{ Form::label('airline_id', 'Airline Id:') }}
<p>{{ $subfleet->airline->name }}</p>
</div>
<!-- Name Field -->
<div class="form-group">
{!! Form::label('name', 'Name:') !!}
<p>{!! $subfleet->name !!}</p>
{{ Form::label('name', 'Name:') }}
<p>{{ $subfleet->name }}</p>
</div>
<!-- Type Field -->
<div class="form-group">
{!! Form::label('type', 'Type:') !!}
<p>{!! $subfleet->type !!}</p>
{{ Form::label('type', 'Type:') }}
<p>{{ $subfleet->type }}</p>
</div>
<!-- Created At Field -->
<div class="form-group">
{!! Form::label('created_at', 'Created At:') !!}
<p>{!! show_datetime($subfleet->created_at) !!}</p>
{{ Form::label('created_at', 'Created At:') }}
<p>{{ show_datetime($subfleet->created_at) }}</p>
</div>
<!-- Updated At Field -->
<div class="form-group">
{!! Form::label('updated_at', 'Updated At:') !!}
<p>{!! show_datetime($subfleet->updated_at) !!}</p>
{{ Form::label('updated_at', 'Updated At:') }}
<p>{{ show_datetime($subfleet->updated_at) }}</p>
</div>

18
resources/views/admin/subfleets/table.blade.php
View File

@@ -10,23 +10,23 @@
@foreach($subfleets as $subfleet)
<tr>
<td>
<a href="{!! route('admin.subfleets.edit', [$subfleet->id]) !!}">
{!! $subfleet->name !!}
<a href="{{ route('admin.subfleets.edit', [$subfleet->id]) }}">
{{ $subfleet->name }}
</a>
</td>
<td>{!! $subfleet->airline->name !!}</td>
<td>{!! $subfleet->type !!}</td>
<td>{{ $subfleet->airline->name }}</td>
<td>{{ $subfleet->type }}</td>
<td class="text-right">
{!! Form::open(['route' => ['admin.subfleets.destroy', $subfleet->id], 'method' => 'delete']) !!}
{{ Form::open(['route' => ['admin.subfleets.destroy', $subfleet->id], 'method' => 'delete']) }}
<a href="{!! route('admin.subfleets.edit', [$subfleet->id]) !!}" class='btn btn-sm btn-success btn-icon'>
<a href="{{ route('admin.subfleets.edit', [$subfleet->id]) }}" class='btn btn-sm btn-success btn-icon'>
<i class="fas fa-pencil-alt"></i></a>
{!! Form::button('<i class="fa fa-times"></i>',
{{ Form::button('<i class="fa fa-times"></i>',
['type' => 'submit', 'class' => 'btn btn-sm btn-danger btn-icon',
'onclick' => "return confirm('Are you sure?')"]) !!}
{!! Form::close() !!}
'onclick' => "return confirm('Are you sure?')"]) }}
{{ Form::close() }}
</td>
</tr>
@endforeach