groove/Part-DB-server
1
0
Fork 0
mirror of https://github.com/Part-DB/Part-DB-server.git synced 2026-07-27 11:41:36 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 5
5112 commits 19 branches 94 tags 91 MiB
Commit graph

29 commits

Author SHA1 Message Date
tonghuaroot
c2ec0ee12b Escape user-controlled element/collection names in CollectionElementDeleted log rendering 
LogEntryExtraFormatter::getInternalFormat() escapes user-controlled
strings with htmlspecialchars() in every branch except the
CollectionElementDeleted one, which interpolates getOldName() and
getCollectionName() into the returned HTML unescaped. That string is
rendered as raw HTML by LogEntryExtraColumn in the activity-log and
element-history DataTables, so a name set on a deleted sub-element
(parameter/attachment/lot/orderdetail) by a low-privileged editor is
parsed as live markup in a log viewer's browser (stored XSS / HTML
injection).

Wrap both values in htmlspecialchars(), matching the sibling branches
(e.g. ElementDeletedLogEntry at the old_name line).
 2026-06-07 18:04:40 +02:00
Jan Böhmer
20f32c7f12 Applied rector suggestions 2024-06-22 00:31:43 +02:00
Jan Böhmer
b447a69dae Allow to specify an informational field during a part stock operation, where the user can specify, when this operation was really performed 
Fixes issue #416
 2023-11-25 19:10:18 +01:00
Jan Böhmer
8a20584e27 Use enum for undo mode 2023-06-18 21:26:28 +02:00
Jan Böhmer
7d99607919 Use an enum for the part stock change type 2023-06-18 20:42:05 +02:00
Jan Böhmer
6a2ff9d153 Added declare strict types to all files 2023-06-11 18:59:07 +02:00
Jan Böhmer
7ee01d9a05 Applied rector with PHP8.1 migration rules 2023-06-11 14:17:19 +02:00
Jan Böhmer
5a3fc0fb43 Show and link which log entry was undone/reverted on log detail page 2023-05-15 22:42:08 +02:00
Jan Böhmer
d04d743520 Fixed typos 2023-04-15 23:14:53 +02:00
Jan Böhmer
83cd91f1d1 Fixed potential XSS injection vectors in datatables columns 2023-02-26 01:23:36 +01:00
Jan Böhmer
6b06ce9ac3 Started to make changed fields names in element edited log entry extra data translatable 2023-02-11 23:39:11 +01:00
Jan Böhmer
5d6b7a9470 Improved the rendering of a part instock change log entry 2023-01-08 01:41:04 +01:00
Jan Böhmer
4c94d9c150 Write a special log entry to DB when a user withdraws/add/move parts stock 2023-01-08 01:22:02 +01:00
Jan Böhmer
68462185ba Removed old GPLv2 copyright header 2022-11-29 22:28:53 +01:00
Jan Böhmer
51e05a8669 Use typed properties 2022-09-18 22:59:31 +02:00
Jan Böhmer
e01b06fb85 Fixed some inspection issues. 2020-08-21 22:43:37 +02:00
Jan Böhmer
d0b1024d80 Fixed code style. 2020-08-21 21:36:22 +02:00
Jan Böhmer
470cd2af9e Log security related events like password reset, 2FA method added, etc. 2020-04-03 18:27:47 +02:00
Jan Böhmer
fd61c8d9e2 Fixed coding style. 2020-03-15 13:56:31 +01:00
Jan Böhmer
70abc47ae0 Improved event log console output. 2020-03-07 22:22:23 +01:00
Jan Böhmer
a05b1684e6 Improved log extra column. 2020-03-07 22:12:32 +01:00
Jan Böhmer
5a5d7b24be Allow to undo a change from event log. 2020-03-01 19:46:48 +01:00
Jan Böhmer
f604022e49 Allow to show collection elements that were deleted before by timetravel 2020-02-29 22:53:53 +01:00
Jan Böhmer
2bc6a2be3c Show in log which fields were changed in a ElementEditedLogEntry. 2020-02-23 20:16:28 +01:00
Jan Böhmer
b6f95ebe48 Allow to add a comment when editing/creating/deleting an element. 2020-02-23 00:44:52 +01:00
Jan Böhmer
9e8771a4ee Changed license to AGPL3+ 2020-02-22 18:14:36 +01:00
Jan Böhmer
8a7b90d0ea Fixed exception in system log. 2020-02-06 14:03:25 +01:00
Jan Böhmer
f2ff77a8b3 Fixed coding style. 2020-02-01 16:17:20 +01:00
Jan Böhmer
3178dcbb6c Added a console command to view the event log. 2020-01-26 20:12:08 +01:00