Przeglądaj źródła

[search] Strip script tag from HTML template

Enrico Berti 10 lat temu
rodzic
commit
d9734680eb

+ 1 - 1
apps/search/src/search/templates/search.mako

@@ -631,7 +631,7 @@ ${ dashboard.layout_skeleton() }
       <div class="widget-section widget-html-section" style="display: none">
         <div class="row-fluid">
           <div class="span9">
-            <textarea data-bind="codemirror: {data: $root.collection.template.template, lineNumbers: true, htmlMode: true, mode: 'text/html' }" data-template="true"></textarea>
+            <textarea data-bind="codemirror: {data: $root.collection.template.template, lineNumbers: true, htmlMode: true, mode: 'text/html', stripScript: true }" data-template="true"></textarea>
           </div>
           <div class="span3">
             <h5 class="editor-title">${_('Available Fields')}</h5>

+ 5 - 1
desktop/core/src/desktop/static/desktop/js/ko.hue-bindings.js

@@ -744,7 +744,11 @@ ko.bindingHandlers.codemirror = {
       clearTimeout(sourceDelay);
       var _cm = cm;
       sourceDelay = setTimeout(function () {
-        valueAccessor().data(_cm.getValue());
+        var _value = _cm.getValue();
+        if (options.stripScript){
+          _value = _value.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, "");
+        }
+        valueAccessor().data(_value);
         if ($(".widget-html-pill").parent().hasClass("active")) {
           $("[contenteditable=true]").html(stripHtmlFromFunctions(valueAccessor().data()));
         }