lunax/snipe_it
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity Actions

Merge pull request #10361 from snipe/fixes/xss_in_accessories_checkout_notes

Browse source 
Escape notes in transformCheckedOutAccessory
This commit is contained in:
snipe 2021-11-24 19:56:36 -08:00 • committed by GitHub
commit ff81e6d536
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
app/Http/Transformers/AccessoriesTransformer.php
View file

@ -82,7 +82,7 @@ class AccessoriesTransformer
'first_name'=> e($user->first_name), 'first_name'=> e($user->first_name),
'last_name'=> e($user->last_name), 'last_name'=> e($user->last_name),
'employee_number' => e($user->employee_num), 'employee_number' => e($user->employee_num),
'checkout_notes' => $user->pivot->note, 'checkout_notes' => e($user->pivot->note),
'last_checkout' => Helper::getFormattedDateObject($user->pivot->created_at, 'datetime'), 'last_checkout' => Helper::getFormattedDateObject($user->pivot->created_at, 'datetime'),
'type' => 'user', 'type' => 'user',
'available_actions' => ['checkin' => true] 'available_actions' => ['checkin' => true]