Skip to content

fix security issue #1333 #1565

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
DonnieBLT merged 4 commits into from
Nov 2, 2023
Merged

fix security issue #1333 #1565

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
0a01276
fix security issue #1333
JisanAR03 Nov 2, 2023
10ef4fe
fix security issue #1337
JisanAR03 Nov 2, 2023
4fce8fb
Merge branch 'main' into issue-#1333
DonnieBLT Nov 2, 2023
ce6088e
Merge branch 'main' into issue-#1333
DonnieBLT Nov 2, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 11 additions & 8 deletions website/templates/report.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -401,14 +401,17 @@ <h2 class="text-2xl font-semibold leading-7 text-gray-900">

fileList.map(file => {
let src = URL.createObjectURL(file);
$("#files_manage").append(`
<div class="w-full md:w-[300px] h-[180px] overflow-hidden rounded-lg" onclick="previewFile('${file.name}')">
<div class="w-full h-10 flex justify-center rounded-t-lg p-2 bg-gray-500">
<p class="text-xl text-white font-bold">${file.name.slice(0,20)}...</p>
</div>
<img class="object-cover" src="${src}" alt="">
</div>
`)
let safeName = $("<div>").text(file.name).html();
let safeNameDisplay = safeName.slice(0, 20) + (safeName.length > 20 ? "..." : "");
// Use the safe name for display and in the onclick handler
let fileDiv = $("<div>").addClass("w-full md:w-[300px] h-[180px] overflow-hidden rounded-lg").attr("onclick", `previewFile('${safeName}')`);
let titleDiv = $("<div>").addClass("w-full h-10 flex justify-center rounded-t-lg p-2 bg-gray-500");
let titleP = $("<p>").addClass("text-xl text-white font-bold").text(safeNameDisplay);
let img = $("<img>").addClass("object-cover").attr("src", escapeHtml(src));

titleDiv.append(titleP);
fileDiv.append(titleDiv).append(img);
$("#files_manage").append(fileDiv);
})

});
Expand Down