Fixing XSS vulnerability by using the proper output tags
This commit is contained in:
Nabeel Shahzad
@@ -3,9 +3,9 @@
|
||||
@section('content')
|
||||
<div class="card border-blue-bottom">
|
||||
<div class="content">
|
||||
{!! Form::open(['route' => 'admin.airlines.store']) !!}
|
||||
{{ Form::open(['route' => 'admin.airlines.store']) }}
|
||||
@include('admin.airlines.fields')
|
||||
{!! Form::close() !!}
|
||||
{{ Form::close() }}
|
||||
</div>
|
||||
</div>
|
||||
@endsection
|
||||
|
||||
@@ -3,9 +3,9 @@
|
||||
@section('content')
|
||||
<div class="card border-blue-bottom">
|
||||
<div class="content">
|
||||
{!! Form::model($user, ['route' => ['admin.users.update', $user->id], 'method' => 'patch']) !!}
|
||||
{{ Form::model($user, ['route' => ['admin.users.update', $user->id], 'method' => 'patch']) }}
|
||||
@include('admin.users.fields')
|
||||
{!! Form::close() !!}
|
||||
{{ Form::close() }}
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
@@ -1,19 +1,19 @@
|
||||
<div class="row">
|
||||
<div class="form-group col-sm-4">
|
||||
{!! Form::label('name', 'Name:') !!}
|
||||
{!! Form::text('name', null, ['class' => 'form-control']) !!}
|
||||
{{ Form::label('name', 'Name:') }}
|
||||
{{ Form::text('name', null, ['class' => 'form-control']) }}
|
||||
<p class="text-danger">{{ $errors->first('name') }}</p>
|
||||
</div>
|
||||
|
||||
<div class="form-group col-sm-4">
|
||||
{!! Form::label('email', 'Email:') !!}
|
||||
{!! Form::text('email', null, ['class' => 'form-control']) !!}
|
||||
{{ Form::label('email', 'Email:') }}
|
||||
{{ Form::text('email', null, ['class' => 'form-control']) }}
|
||||
<p class="text-danger">{{ $errors->first('email') }}</p>
|
||||
</div>
|
||||
|
||||
<div class="form-group col-sm-4">
|
||||
{!! Form::label('password', 'Password:') !!}
|
||||
{!! Form::password('password', ['class' => 'form-control']) !!}
|
||||
{{ Form::label('password', 'Password:') }}
|
||||
{{ Form::password('password', ['class' => 'form-control']) }}
|
||||
<p class="text-danger">{{ $errors->first('password') }}</p>
|
||||
</div>
|
||||
</div>
|
||||
@@ -21,23 +21,23 @@
|
||||
<div class="row">
|
||||
<div class="form-group col-sm-6">
|
||||
<div class="form-group">
|
||||
{!! Form::label('country', 'Country:') !!} <br />
|
||||
{!! Form::select('country', $countries, null, ['class' => 'select2' ]); !!}
|
||||
{{ Form::label('country', 'Country:') }} <br />
|
||||
{{ Form::select('country', $countries, null, ['class' => 'select2' ]) }}
|
||||
<p class="text-danger">{{ $errors->first('country') }}</p>
|
||||
</div>
|
||||
<div class="form-group">
|
||||
{!! Form::label('timezone', 'Timezone:') !!} <br/>
|
||||
{!! Form::select('timezone', $timezones, null, ['id' => 'timezone', 'class' => 'select2' ]); !!}
|
||||
{{ Form::label('timezone', 'Timezone:') }} <br/>
|
||||
{{ Form::select('timezone', $timezones, null, ['id' => 'timezone', 'class' => 'select2' ]) }}
|
||||
<p class="text-danger">{{ $errors->first('timezone') }}</p>
|
||||
</div>
|
||||
</div>
|
||||
<div class="form-group col-sm-6">
|
||||
{!! Form::label('home_airport_id', 'Home Airport:') !!}
|
||||
{!! Form::select('home_airport_id', $airports, null , ['class' => 'form-control select2']) !!}
|
||||
{{ Form::label('home_airport_id', 'Home Airport:') }}
|
||||
{{ Form::select('home_airport_id', $airports, null , ['class' => 'form-control select2']) }}
|
||||
<p class="text-danger">{{ $errors->first('home_airport_id') }}</p>
|
||||
<br /><br />
|
||||
{!! Form::label('curr_airport_id', 'Current Airport:') !!}
|
||||
{!! Form::select('curr_airport_id', $airports, null , ['class' => 'form-control select2']) !!}
|
||||
{{ Form::label('curr_airport_id', 'Current Airport:') }}
|
||||
{{ Form::select('curr_airport_id', $airports, null , ['class' => 'form-control select2']) }}
|
||||
<p class="text-danger">{{ $errors->first('curr_airport_id') }}</p>
|
||||
</div>
|
||||
|
||||
@@ -45,37 +45,37 @@
|
||||
|
||||
<div class="row">
|
||||
<div class="form-group col-sm-4">
|
||||
{!! Form::label('airline_id', 'Airline:') !!}
|
||||
{!! Form::select('airline_id', $airlines, null, ['class' => 'form-control select2', 'placeholder' => 'Select Airline']) !!}
|
||||
{{ Form::label('airline_id', 'Airline:') }}
|
||||
{{ Form::select('airline_id', $airlines, null, ['class' => 'form-control select2', 'placeholder' => 'Select Airline']) }}
|
||||
</div>
|
||||
|
||||
<div class="form-group col-sm-4">
|
||||
{!! Form::label('rank_id', 'Rank:') !!}
|
||||
{!! Form::select('rank_id', $ranks, null, ['class' => 'form-control select2', 'placeholder' => 'Select Rank']) !!}
|
||||
{{ Form::label('rank_id', 'Rank:') }}
|
||||
{{ Form::select('rank_id', $ranks, null, ['class' => 'form-control select2', 'placeholder' => 'Select Rank']) }}
|
||||
</div>
|
||||
|
||||
<div class="form-group col-sm-4">
|
||||
{!! Form::label('roles', 'Roles:') !!}
|
||||
{!! Form::select('roles[]', $roles, $user->roles->pluck('id'),
|
||||
['class' => 'form-control select2', 'placeholder' => 'Select Roles', 'multiple']) !!}
|
||||
{{ Form::label('roles', 'Roles:') }}
|
||||
{{ Form::select('roles[]', $roles, $user->roles->pluck('id'),
|
||||
['class' => 'form-control select2', 'placeholder' => 'Select Roles', 'multiple']) }}
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="row">
|
||||
<div class="form-group col-sm-6">
|
||||
{!! Form::label('state', 'State:') !!}
|
||||
{{ Form::label('state', 'State:') }}
|
||||
<label class="checkbox-inline">
|
||||
{!! Form::select('state', UserState::labels(), null, ['class' => 'form-control select2']) !!}
|
||||
{{ Form::select('state', UserState::labels(), null, ['class' => 'form-control select2']) }}
|
||||
</label>
|
||||
</div>
|
||||
|
||||
<!-- Submit Field -->
|
||||
<div class="form-group col-sm-6 text-right">
|
||||
{{--<a href="{!! route('admin.users.regen_apikey', ['id' => $user->id]) !!}" class="btn btn-warning"
|
||||
{{--<a href="{{ route('admin.users.regen_apikey', ['id' => $user->id]) }}" class="btn btn-warning"
|
||||
onclick="return confirm('Are you sure? This will reset this user\'s API key.')">new api key</a>--}}
|
||||
|
||||
{!! Form::button('Save', ['type' => 'submit', 'class' => 'btn btn-success']) !!}
|
||||
<a href="{!! route('admin.users.index') !!}" class="btn btn-default">Cancel</a>
|
||||
{{ Form::button('Save', ['type' => 'submit', 'class' => 'btn btn-success']) }}
|
||||
<a href="{{ route('admin.users.index') }}" class="btn btn-default">Cancel</a>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
@@ -84,27 +84,27 @@
|
||||
<table class="table table-hover">
|
||||
{{--<tr>
|
||||
<td>API Key</td>
|
||||
<td>{!! $user->api_key !!}</td>
|
||||
<td>{{ $user->api_key }}</td>
|
||||
</tr>--}}
|
||||
<tr>
|
||||
<td>Total Flights</td>
|
||||
<td>{!! $user->flights !!}</td>
|
||||
<td>{{ $user->flights }}</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Flight Time</td>
|
||||
<td>{!! Utils::minutesToTimeString($user->flight_time) !!}</td>
|
||||
<td>{{ Utils::minutesToTimeString($user->flight_time) }}</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>IP Address</td>
|
||||
<td>{!! $user->last_ip !!}</td>
|
||||
<td>{{ $user->last_ip }}</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Registered On</td>
|
||||
<td>{!! show_datetime($user->created_at) !!}</td>
|
||||
<td>{{ show_datetime($user->created_at) }}</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Last Login</td>
|
||||
<td>{!! show_datetime($user->updated_at) !!}</td>
|
||||
<td>{{ show_datetime($user->updated_at) }}</td>
|
||||
</tr>
|
||||
</table>
|
||||
</div>
|
||||
|
||||
@@ -2,8 +2,8 @@
|
||||
|
||||
@section('title', 'Users')
|
||||
@section('actions')
|
||||
<li><a href="{!! route('admin.users.index') !!}?search=state:0">
|
||||
<i class="ti-user"></i>{!! UserState::label(UserState::PENDING) !!}</a>
|
||||
<li><a href="{{ route('admin.users.index') }}?search=state:0">
|
||||
<i class="ti-user"></i>{{ UserState::label(UserState::PENDING) }}</a>
|
||||
</li>
|
||||
@endsection
|
||||
|
||||
|
||||
@@ -2,24 +2,24 @@
|
||||
<div class="row">
|
||||
<div class="col-sm-12">
|
||||
<div class="form-group">
|
||||
{!! Form::open(['route' => 'admin.users.index', 'method' => 'GET', 'class'=>'form-inline pull-right']) !!}
|
||||
{{ Form::open(['route' => 'admin.users.index', 'method' => 'GET', 'class'=>'form-inline pull-right']) }}
|
||||
|
||||
{!! Form::label('name', 'Name:') !!}
|
||||
{!! Form::text('name', null, ['class' => 'form-control']) !!}
|
||||
{{ Form::label('name', 'Name:') }}
|
||||
{{ Form::text('name', null, ['class' => 'form-control']) }}
|
||||
|
||||
{!! Form::label('email', 'Email:') !!}
|
||||
{!! Form::text('email', null, ['class' => 'form-control']) !!}
|
||||
{{ Form::label('email', 'Email:') }}
|
||||
{{ Form::text('email', null, ['class' => 'form-control']) }}
|
||||
|
||||
{{--{!! Form::label('dep_icao', 'Departure:') !!}
|
||||
{!! Form::select('dep_icao', $airports, null , ['class' => 'form-control']) !!}
|
||||
{{--{{ Form::label('dep_icao', 'Departure:') }}
|
||||
{{ Form::select('dep_icao', $airports, null , ['class' => 'form-control']) }}
|
||||
|
||||
{!! Form::label('arr_icao', 'Arrival:') !!}
|
||||
{!! Form::select('arr_icao', $airports, null , ['class' => 'form-control']) !!}
|
||||
{{ Form::label('arr_icao', 'Arrival:') }}
|
||||
{{ Form::select('arr_icao', $airports, null , ['class' => 'form-control']) }}
|
||||
--}}
|
||||
{!! Form::submit('find', ['class' => 'btn btn-primary']) !!}
|
||||
{{ Form::submit('find', ['class' => 'btn btn-primary']) }}
|
||||
|
||||
<a href="{!! route('admin.users.index') !!}">clear</a>
|
||||
{!! Form::close() !!}
|
||||
<a href="{{ route('admin.users.index') }}">clear</a>
|
||||
{{ Form::close() }}
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
@@ -11,14 +11,14 @@
|
||||
<tr>
|
||||
<td>
|
||||
@if(filled($user->country))
|
||||
<span class="flag-icon flag-icon-{!! $user->country !!}"
|
||||
title="{!! $country->alpha2($user->country)['name'] !!}"></span>
|
||||
<span class="flag-icon flag-icon-{{ $user->country }}"
|
||||
title="{{ $country->alpha2($user->country)['name'] }}"></span>
|
||||
|
||||
@endif
|
||||
<a href="{!! route('admin.users.edit', [$user->id]) !!}">{!! $user->name !!}</a>
|
||||
<a href="{{ route('admin.users.edit', [$user->id]) }}">{{ $user->name }}</a>
|
||||
</td>
|
||||
<td>{!! $user->email !!}</td>
|
||||
<td>{!! show_date($user->created_at) !!}</td>
|
||||
<td>{{ $user->email }}</td>
|
||||
<td>{{ show_date($user->created_at) }}</td>
|
||||
<td class="text-center">
|
||||
@if($user->state === UserState::ACTIVE)
|
||||
<span class="label label-success">
|
||||
@@ -27,15 +27,15 @@
|
||||
@else
|
||||
<span class="label label-default">
|
||||
@endif
|
||||
{!! UserState::label($user->state) !!}</span>
|
||||
{{ UserState::label($user->state) }}</span>
|
||||
</td>
|
||||
<td class="text-right">
|
||||
{!! Form::open(['route' => ['admin.users.destroy', $user->id], 'method' => 'delete']) !!}
|
||||
<a href="{!! route('admin.users.edit', [$user->id]) !!}"
|
||||
{{ Form::open(['route' => ['admin.users.destroy', $user->id], 'method' => 'delete']) }}
|
||||
<a href="{{ route('admin.users.edit', [$user->id]) }}"
|
||||
class='btn btn-sm btn-success btn-icon'>
|
||||
<i class="fas fa-pencil-alt"></i></a>
|
||||
{!! Form::button('<i class="fa fa-times"></i>', ['type' => 'submit', 'class' => 'btn btn-sm btn-danger btn-icon', 'onclick' => "return confirm('Are you sure?')"]) !!}
|
||||
{!! Form::close() !!}
|
||||
{{ Form::button('<i class="fa fa-times"></i>', ['type' => 'submit', 'class' => 'btn btn-sm btn-danger btn-icon', 'onclick' => "return confirm('Are you sure?')"]) }}
|
||||
{{ Form::close() }}
|
||||
</td>
|
||||
</tr>
|
||||
@endforeach
|
||||
|
||||
Reference in New Issue
Block a user