groove/Part-DB-server
1
0
Fork 0
mirror of https://github.com/Part-DB/Part-DB-server.git synced 2026-08-01 14:11:47 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Properly HTML escape fields for label template placeholders

Browse source 
Fixes issue #1446
This commit is contained in:
Jan Böhmer 2026-07-19 14:03:14 +02:00
parent 5054642d41
commit dcc431d28c
10 changed files with 43 additions and 42 deletions
Download patch file Download diff file Expand all files Collapse all files

12
src/Services/LabelSystem/PlaceholderProviders/GlobalProviders.php
View file

@ -53,11 +53,11 @@ use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
* Provides Placeholders for infos about global infos like Installation name or datetimes.
* @see \App\Tests\Services\LabelSystem\PlaceholderProviders\GlobalProvidersTest
*/
final class GlobalProviders implements PlaceholderProviderInterface
final readonly class GlobalProviders implements PlaceholderProviderInterface
{
public function __construct(
private readonly Security $security,
private readonly UrlGeneratorInterface $url_generator,
private Security $security,
private UrlGeneratorInterface $url_generator,
private CustomizationSettings $customizationSettings,
)
{
@ -66,13 +66,13 @@ final class GlobalProviders implements PlaceholderProviderInterface
public function replace(string $placeholder, object $label_target, array $options = []): ?string
{
if ('[[INSTALL_NAME]]' === $placeholder) {
return $this->customizationSettings->instanceName;
return htmlspecialchars($this->customizationSettings->instanceName);
}
$user = $this->security->getUser();
if ('[[USERNAME]]' === $placeholder) {
if ($user instanceof User) {
return $user->getName();
return htmlspecialchars($user->getName());
}
return 'anonymous';
@ -80,7 +80,7 @@ final class GlobalProviders implements PlaceholderProviderInterface
if ('[[USERNAME_FULL]]' === $placeholder) {
if ($user instanceof User) {
return $user->getFullName(true);
return htmlspecialchars($user->getFullName(true));
}
return 'anonymous';