mirror of
https://github.com/Part-DB/Part-DB-server.git
synced 2026-08-04 07:31:40 +00:00
c2ec0ee12b
LogEntryExtraFormatter::getInternalFormat() escapes user-controlled strings with htmlspecialchars() in every branch except the CollectionElementDeleted one, which interpolates getOldName() and getCollectionName() into the returned HTML unescaped. That string is rendered as raw HTML by LogEntryExtraColumn in the activity-log and element-history DataTables, so a name set on a deleted sub-element (parameter/attachment/lot/orderdetail) by a low-privileged editor is parsed as live markup in a log viewer's browser (stored XSS / HTML injection). Wrap both values in htmlspecialchars(), matching the sibling branches (e.g. ElementDeletedLogEntry at the old_name line). |
||
|---|---|---|
| .. | ||
| EventCommentHelper.php | ||
| EventCommentNeededHelper.php | ||
| EventCommentType.php | ||
| EventLogger.php | ||
| EventUndoHelper.php | ||
| EventUndoMode.php | ||
| HistoryHelper.php | ||
| LogDataFormatter.php | ||
| LogDiffFormatter.php | ||
| LogEntryExtraFormatter.php | ||
| LogLevelHelper.php | ||
| LogTargetHelper.php | ||
| TimeTravel.php | ||