lunax/snipe_it
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity Actions

Merge pull request #10971 from snipe/fixes/potential_xss_in_depreciation

Browse source 
Escape checkout target name
This commit is contained in:
snipe 2022-04-24 15:27:58 +01:00 • committed by GitHub
commit 0abc108686
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
app/Http/Transformers/DepreciationReportTransformer.php
View file

@ -98,7 +98,7 @@ class DepreciationReportTransformer
'purchase_cost' => Helper::formatCurrencyOutput($asset->purchase_cost),
'book_value' => Helper::formatCurrencyOutput($depreciated_value),
'monthly_depreciation' => $monthly_depreciation,
'checked_out_to' => $checkout_target,
'checked_out_to' => ($checkout_target) ? e($checkout_target) : null,
'diff' => Helper::formatCurrencyOutput($diff),
'number_of_months' => ($asset->model && $asset->model->depreciation) ? e($asset->model->depreciation->months) : null,
'depreciation' => (($asset->model) && ($asset->model->depreciation)) ? e($asset->model->depreciation->name) : null,