Skip to content

Commit 94cbfab

Browse files
author
baserproject
authored
Merge pull request from GHSA-4r3m-j6x5-48m3
fix security/advisories/GHSA-4r3m-j6x5-48m3
2 parents 1a2fb07 + 233bd0b commit 94cbfab

File tree

2 files changed

+40
-36
lines changed

2 files changed

+40
-36
lines changed

‎app/webroot/theme/admin-third/Elements/admin/toolbar.php‎

Lines changed: 38 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -39,52 +39,54 @@
3939
<div id="ToolBar" class="bca-toolbar">
4040
<div id="ToolbarInner" class="clearfix bca-toolbar__body">
4141
<div class="bca-toolbar__logo">
42-
<?php
43-
# インストール画面
44-
if ($this->name == 'Installations'): ?>
42+
<?php // インストール画面 ?>
43+
<?php if ($this->name == 'Installations'): ?>
4544
<?php $this->BcBaser->link(
4645
$this->BcBaser->getImg('admin/logo_icon.svg', ['alt' => '', 'width' => '24', 'height' => '21', 'class' => 'bca-toolbar__logo-symbol']) .
4746
'<span class="bca-toolbar__logo-text">' . __d('baser', 'インストールマニュアル') . '</span>',
48-
'https://basercms.net/manuals/introductions/4.html', ['target' => '_blank', 'class' => 'bca-toolbar__logo-link']) ?>
49-
<?php
50-
# バージョンアップ画面
51-
elseif (Configure::read('BcRequest.isUpdater')): ?>
47+
'https://basercms.net/manuals/introductions/4.html',
48+
['target' => '_blank', 'class' => 'bca-toolbar__logo-link']
49+
) ?>
50+
51+
<?php // バージョンアップ画面 ?>
52+
<?php elseif (Configure::read('BcRequest.isUpdater')): ?>
5253
<?php $this->BcBaser->link(
5354
$this->BcBaser->getImg('admin/logo_icon.svg', ['alt' => '', 'width' => '24', 'height' => '21', 'class' => 'bca-toolbar__logo-symbol']) .
5455
'<span class="bca-toolbar__logo-text">' . __d('baser', 'アップデートマニュアル') . '</span>',
55-
'https://basercms.net/manuals/introductions/8.html', ['target' => '_blank', 'class' => 'bca-toolbar__logo-link']) ?>
56-
<?php
57-
# 通常
58-
elseif (!empty($this->request->params['admin']) || ('/' . $this->request->url) == $loginUrl): ?>
56+
'https://basercms.net/manuals/introductions/8.html',
57+
['target' => '_blank', 'class' => 'bca-toolbar__logo-link']
58+
) ?>
59+
60+
<?php // 通常管理画面 ?>
61+
<?php elseif (!empty($this->request->params['admin']) || ('/' . $this->request->url) == $loginUrl): ?>
5962
<?php
6063
$this->BcBaser->link(
6164
$this->BcBaser->getImg('admin/logo_icon.svg', ['alt' => '', 'width' => '24', 'height' => '21', 'class' => 'bca-toolbar__logo-symbol'])
62-
.'<span class="bca-toolbar__logo-text">'
63-
.$this->BcBaser->siteConfig['formal_name']
64-
.'</span>', '/'
65+
. '<span class="bca-toolbar__logo-text">'
66+
. h($this->BcBaser->siteConfig['formal_name'])
67+
. '</span>', '/'
6568
,
6669
['class' => 'bca-toolbar__logo-link']
6770
)
6871
?>
69-
<?php
70-
else: ?>
71-
<?php
72-
# 管理画面にアクセス可能な権限がある場合
73-
if (in_array('admin', $currentUserAuthPrefixes)): ?>
72+
73+
<?php // 公開画面 ?>
74+
<?php else: ?>
75+
<?php // 管理画面にアクセス可能な権限がある場合 ?>
76+
<?php if (in_array('admin', $currentUserAuthPrefixes)): ?>
7477
<?php
7578
$this->BcBaser->link(
7679
$this->BcBaser->getImg('admin/logo_icon.svg', ['alt' => '', 'width' => '24', 'height' => '21', 'class' => 'bca-toolbar__logo-symbol'])
77-
.'<span class="bca-toolbar__logo-text">'
78-
.$this->BcBaser->siteConfig['formal_name']
79-
.'</span>', ['plugin' => null, 'admin' => true, 'controller' => 'dashboard', 'action' => 'index']
80+
. '<span class="bca-toolbar__logo-text">'
81+
. h($this->BcBaser->siteConfig['formal_name'])
82+
. '</span>', ['plugin' => null, 'admin' => true, 'controller' => 'dashboard', 'action' => 'index']
8083
,
8184
['class' => 'bca-toolbar__logo-link']
8285
)
8386
?>
84-
<?php
85-
# 管理画面にアクセス権限がない場合
86-
else: ?>
87-
<?php $this->BcBaser->link($authName, Configure::read('BcAuthPrefix.' . $currentPrefix . '.loginRedirect'), ['title' => $authName]) ?>
87+
<?php // 管理画面にアクセス権限がない場合 ?>
88+
<?php else: ?>
89+
<?php $this->BcBaser->link(h($authName), Configure::read('BcAuthPrefix.' . $currentPrefix . '.loginRedirect'), ['title' => h($authName)]) ?>
8890
<?php endif ?>
8991
<?php endif ?>
9092
</div>
@@ -112,14 +114,16 @@
112114
<div id="UserMenu" class="bca-toolbar__users">
113115
<ul class="clearfix">
114116
<?php
115-
# TODO: お気に入りを表示（サイドメニューとのイベント処理・同期・スタイルの調整を検討中）
116-
# <li>
117-
# <a href="javascript:void(0)" class="title"><?php echo __d('baser', 'お気に入り') ? ><img src="/theme/admin-third/img/admin/btn_dropdown.png" width="8" height="11" class="bc-btn"></a>
118-
# <div id="FavoriteArea" hidden>
119-
# <?php $this->BcBaser->element('favorite_menu') ? >
120-
# <?php $this->BcBaser->element('permission') ? >
121-
# </div>
122-
#</li>
117+
/**
118+
* TODO: お気に入りを表示（サイドメニューとのイベント処理・同期・スタイルの調整を検討中）
119+
* <li>
120+
* <a href="javascript:void(0)" class="title"><?php echo __d('baser', 'お気に入り') ? ><img src="/theme/admin-third/img/admin/btn_dropdown.png" width="8" height="11" class="bc-btn"></a>
121+
* <div id="FavoriteArea" hidden>
122+
* <?php $this->BcBaser->element('favorite_menu') ? >
123+
* <?php $this->BcBaser->element('permission') ? >
124+
* </div>
125+
* </li>
126+
*/
123127
?>
124128
<li>
125129
<?php if (!empty($user)): ?>

‎lib/Baser/View/Elements/admin/toolbar.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -47,12 +47,12 @@
4747
<?php elseif (Configure::read('BcRequest.isUpdater')): ?>
4848
<li><?php $this->BcBaser->link(__d('baser', 'アップデートマニュアル'), 'http://wiki.basercms.net/%E3%83%90%E3%83%BC%E3%82%B8%E3%83%A7%E3%83%B3%E3%82%A2%E3%83%83%E3%83%97%E3%82%AC%E3%82%A4%E3%83%89', ['target' => '_blank', 'class' => 'tool-menu']) ?></li>
4949
<?php elseif (!empty($this->request->params['admin']) || ('/' . $this->request->url) == $loginUrl): ?>
50-
<li><?php $this->BcBaser->link($this->BcBaser->siteConfig['formal_name'], '/') ?></li>
50+
<li><?php $this->BcBaser->link($this->BcBaser->siteConfig['formal_name'], '/', ['escape' => true]) ?></li>
5151
<?php else: ?>
5252
<?php if (in_array('admin', $currentUserAuthPrefixes)): ?>
5353
<li><?php $this->BcBaser->link($this->BcBaser->getImg('admin/btn_logo.png', ['alt' => __d('baser', 'baserCMS管理システム'), 'class' => 'bc-btn']), ['plugin' => null, 'admin' => true, 'controller' => 'dashboard', 'action' => 'index'], ['title' => __d('baser', 'baserCMS管理システム')]) ?></li>
5454
<?php else: ?>
55-
<li><?php $this->BcBaser->link($authName, Configure::read('BcAuthPrefix.' . $currentPrefix . '.loginRedirect'), ['title' => $authName]) ?></li>
55+
<li><?php $this->BcBaser->link($authName, Configure::read('BcAuthPrefix.' . $currentPrefix . '.loginRedirect'), ['title' => $authName, 'escape' => ture]) ?></li>
5656
<?php endif ?>
5757
<?php endif ?>
5858
<?php if ($this->BcBaser->existsEditLink() && !isset($this->request->query['preview'])): ?>

0 commit comments

Comments
 (0)