vassili/seitime-frappe
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

[communication] [fix] escape script and style in a communication

Browse source
This commit is contained in:
Anand Doshi 2013-06-12 12:31:23 +05:30
parent 05022b7d78
commit d132109430
3 changed files with 8 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
core/doctype/communication/communication.js
View file

@ -29,6 +29,8 @@ cur_frm.cscript.refresh = function(doc, dt, dn) {
});
if(hide_list.length < field_list.length) hide_field(hide_list);
doc.content = wn.utils.escape_script_and_style(doc.content);
}
}

4
public/js/wn/misc/utils.js
View file

@ -16,6 +16,10 @@ wn.utils = {
return txt.toLowerCase().substr(0,7)=='http://'
|| txt.toLowerCase().substr(0,8)=='https://'
},
escape_script_and_style: function(txt) {
return (!txt || (txt.indexOf("<script>")===-1 && txt.indexOf("<style>")===-1)) ? txt :
"<pre>" + $("<div>").text(txt).html() + "</pre>";
},
filter_dict: function(dict, filters) {
var ret = [];
if(typeof filters=='string') {

2
public/js/wn/views/communication.js
View file

@ -77,6 +77,8 @@ wn.views.CommunicationList = Class.extend({
if(!wn.utils.is_html(doc.content)) {
doc.content = doc.content.replace(/\n/g, "<br>");
}
doc.content = wn.utils.escape_script_and_style(doc.content);
if(!doc.sender) doc.sender = "[unknown sender]";
doc._sender = doc.sender.replace(/</, "&lt;").replace(/>/, "&gt;");
doc.content = doc.content.split("-----"+wn._("In response to")+"-----")[0];