Fixing XSS vulnerability by using the proper output tags
This commit is contained in:
Nabeel Shahzad
@@ -28,13 +28,13 @@ flight reports that have been filed. You've been warned!
|
||||
<td>Airline</td>
|
||||
<td>
|
||||
@if($read_only)
|
||||
<p>{!! $pirep->airline->name !!}</p>
|
||||
{!! Form::hidden('airline_id') !!}
|
||||
<p>{{ $pirep->airline->name }}</p>
|
||||
{{ Form::hidden('airline_id') }}
|
||||
@else
|
||||
<div class="input-group form-group">
|
||||
{!! Form::select('airline_id', $airline_list, null, [
|
||||
{{ Form::select('airline_id', $airline_list, null, [
|
||||
'class' => 'custom-select select2',
|
||||
'readonly' => $read_only]) !!}
|
||||
'readonly' => $read_only]) }}
|
||||
</div>
|
||||
<p class="text-danger">{{ $errors->first('airline_id') }}</p>
|
||||
@endif
|
||||
@@ -45,27 +45,27 @@ flight reports that have been filed. You've been warned!
|
||||
<td>Flight Number/Code/Leg</td>
|
||||
<td>
|
||||
@if($read_only)
|
||||
<p>{!! $pirep->ident !!}
|
||||
{!! Form::hidden('flight_number') !!}
|
||||
{!! Form::hidden('flight_code') !!}
|
||||
{!! Form::hidden('flight_leg') !!}
|
||||
<p>{{ $pirep->ident }}
|
||||
{{ Form::hidden('flight_number') }}
|
||||
{{ Form::hidden('flight_code') }}
|
||||
{{ Form::hidden('flight_leg') }}
|
||||
</p>
|
||||
@else
|
||||
<div class="input-group form-group" style="max-width: 400px;">
|
||||
{!! Form::text('flight_number', null, [
|
||||
{{ Form::text('flight_number', null, [
|
||||
'placeholder' => 'Flight Number',
|
||||
'class' => 'form-control',
|
||||
'readonly' => $read_only]) !!}
|
||||
'readonly' => $read_only]) }}
|
||||
|
||||
{!! Form::text('route_code', null, [
|
||||
{{ Form::text('route_code', null, [
|
||||
'placeholder' => 'Code (optional)',
|
||||
'class' => 'form-control',
|
||||
'readonly' => $read_only]) !!}
|
||||
'readonly' => $read_only]) }}
|
||||
|
||||
{!! Form::text('route_leg', null, [
|
||||
{{ Form::text('route_leg', null, [
|
||||
'placeholder' => 'Leg (optional)',
|
||||
'class' => 'form-control',
|
||||
'readonly' => $read_only]) !!}
|
||||
'readonly' => $read_only]) }}
|
||||
</div>
|
||||
<p class="text-danger">{{ $errors->first('flight_number') }}</p>
|
||||
<p class="text-danger">{{ $errors->first('route_code') }}</p>
|
||||
@@ -78,16 +78,16 @@ flight reports that have been filed. You've been warned!
|
||||
<td>Aircraft</td>
|
||||
<td>
|
||||
@if($read_only)
|
||||
<p>{!! $pirep->aircraft->name !!}</p>
|
||||
{!! Form::hidden('aircraft_id') !!}
|
||||
<p>{{ $pirep->aircraft->name }}</p>
|
||||
{{ Form::hidden('aircraft_id') }}
|
||||
@else
|
||||
<div class="input-group form-group">
|
||||
{{-- You probably don't want to change this ID if you want the fare select to work --}}
|
||||
{!! Form::select('aircraft_id', $aircraft_list, null, [
|
||||
{{ Form::select('aircraft_id', $aircraft_list, null, [
|
||||
'id' => 'aircraft_select',
|
||||
'class' => 'custom-select select2',
|
||||
'readonly' => $read_only
|
||||
]) !!}
|
||||
]) }}
|
||||
</div>
|
||||
<p class="text-danger">{{ $errors->first('aircraft_id') }}</p>
|
||||
@endif
|
||||
@@ -98,14 +98,14 @@ flight reports that have been filed. You've been warned!
|
||||
<td>Origin Airport</td>
|
||||
<td>
|
||||
@if($read_only)
|
||||
<p>{!! $pirep->dpt_airport->id !!} - {!! $pirep->dpt_airport->name !!}</p>
|
||||
{!! Form::hidden('dpt_airport_id') !!}
|
||||
<p>{{ $pirep->dpt_airport->id }} - {{ $pirep->dpt_airport->name }}</p>
|
||||
{{ Form::hidden('dpt_airport_id') }}
|
||||
@else
|
||||
<div class="input-group form-group">
|
||||
{!! Form::select('dpt_airport_id', $airport_list, null, [
|
||||
{{ Form::select('dpt_airport_id', $airport_list, null, [
|
||||
'class' => 'custom-select select2',
|
||||
'readonly' => $read_only
|
||||
]) !!}
|
||||
]) }}
|
||||
</div>
|
||||
<p class="text-danger">{{ $errors->first('dpt_airport_id') }}</p>
|
||||
@endif
|
||||
@@ -116,15 +116,15 @@ flight reports that have been filed. You've been warned!
|
||||
<td>Arrival Airport</td>
|
||||
<td>
|
||||
@if($read_only)
|
||||
<p>{!! $pirep->arr_airport->id !!}
|
||||
- {!! $pirep->arr_airport->name !!}</p>
|
||||
{!! Form::hidden('arr_airport_id') !!}
|
||||
<p>{{ $pirep->arr_airport->id }}
|
||||
- {{ $pirep->arr_airport->name }}</p>
|
||||
{{ Form::hidden('arr_airport_id') }}
|
||||
@else
|
||||
<div class="input-group form-group">
|
||||
{!! Form::select('arr_airport_id', $airport_list, null, [
|
||||
{{ Form::select('arr_airport_id', $airport_list, null, [
|
||||
'class' => 'custom-select select2',
|
||||
'readonly' => $read_only
|
||||
]) !!}
|
||||
]) }}
|
||||
</div>
|
||||
<p class="text-danger">{{ $errors->first('arr_airport_id') }}</p>
|
||||
@endif
|
||||
@@ -136,25 +136,25 @@ flight reports that have been filed. You've been warned!
|
||||
<td>
|
||||
@if($read_only)
|
||||
<p>
|
||||
{!! $pirep->hours !!} hours, {!! $pirep->minutes !!} minutes
|
||||
{!! Form::hidden('hours') !!}
|
||||
{!! Form::hidden('minutes') !!}
|
||||
{{ $pirep->hours }} hours, {{ $pirep->minutes }} minutes
|
||||
{{ Form::hidden('hours') }}
|
||||
{{ Form::hidden('minutes') }}
|
||||
</p>
|
||||
@else
|
||||
<div class="input-group" style="max-width: 200px;">
|
||||
{!! Form::number('hours', null, [
|
||||
{{ Form::number('hours', null, [
|
||||
'class' => 'form-control',
|
||||
'placeholder' => 'hours',
|
||||
'min' => '0',
|
||||
'readonly' => $read_only
|
||||
]) !!}
|
||||
]) }}
|
||||
|
||||
{!! Form::number('minutes', null, [
|
||||
{{ Form::number('minutes', null, [
|
||||
'class' => 'form-control',
|
||||
'placeholder' => 'minutes',
|
||||
'min' => 0,
|
||||
'readonly' => $read_only
|
||||
]) !!}
|
||||
]) }}
|
||||
</div>
|
||||
<p class="text-danger">{{ $errors->first('hours') }}</p>
|
||||
<p class="text-danger">{{ $errors->first('minutes') }}</p>
|
||||
@@ -168,16 +168,16 @@ flight reports that have been filed. You've been warned!
|
||||
@foreach($pirep_fields as $field)
|
||||
<tr>
|
||||
<td>
|
||||
{!! $field->name !!}
|
||||
{{ $field->name }}
|
||||
@if($field->required === true)
|
||||
<span class="text-danger">*</span>
|
||||
@endif
|
||||
</td>
|
||||
<td>
|
||||
<div class="input-group form-group">
|
||||
{!! Form::text($field->slug, null, [
|
||||
{{ Form::text($field->slug, null, [
|
||||
'class' => 'form-control'
|
||||
]) !!}
|
||||
]) }}
|
||||
</div>
|
||||
<p class="text-danger">{{ $errors->first($field->slug) }}</p>
|
||||
</td>
|
||||
@@ -188,7 +188,7 @@ flight reports that have been filed. You've been warned!
|
||||
<td class="align-text-top">Route</td>
|
||||
<td>
|
||||
<div class="input-group form-group">
|
||||
{!! Form::textarea('route', null, ['class' => 'form-control', 'placeholder' => 'Route']) !!}
|
||||
{{ Form::textarea('route', null, ['class' => 'form-control', 'placeholder' => 'Route']) }}
|
||||
</div>
|
||||
<p class="text-danger">{{ $errors->first('route') }}</p>
|
||||
</td>
|
||||
@@ -198,7 +198,7 @@ flight reports that have been filed. You've been warned!
|
||||
<td class="align-text-top"><p class="">Notes</p></td>
|
||||
<td>
|
||||
<div class="input-group form-group">
|
||||
{!! Form::textarea('notes', null, ['class' => 'form-control', 'placeholder' => 'Notes']) !!}
|
||||
{{ Form::textarea('notes', null, ['class' => 'form-control', 'placeholder' => 'Notes']) }}
|
||||
</div>
|
||||
<p class="text-danger">{{ $errors->first('notes') }}</p>
|
||||
</td>
|
||||
@@ -218,7 +218,7 @@ flight reports that have been filed. You've been warned!
|
||||
<div class="col-sm-12">
|
||||
<div class="float-right">
|
||||
<div class="form-group">
|
||||
{!! Form::submit('Save PIREP', ['class' => 'btn btn-primary']) !!}
|
||||
{{ Form::submit('Save PIREP', ['class' => 'btn btn-primary']) }}
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
Reference in New Issue
Block a user