${e.innerText}
`;
+ details += `${_.escape(e.innerText)}
`;
in_details = true;
} else {
if (in_details) {
- details += e.innerText;
+ details += _.escape(e.innerText);
}
}
});
@@ -1555,7 +1556,7 @@ $(document.body).on('shown.bs.tab', 'a[data-bs-toggle="tab"]', (e) => {
* @param {string} item The ID of the field to be shown
*/
function showDisclosablePasswordField(item) {
- $("#" + item).prop("type", "text");
+ $("#" + CSS.escape(item)).prop("type", "text");
}
/**
@@ -1563,7 +1564,7 @@ function showDisclosablePasswordField(item) {
* @param {string} item The ID of the field to be hidden
*/
function hideDisclosablePasswordField(item) {
- $("#" + item).prop("type", "password");
+ $("#" + CSS.escape(item)).prop("type", "password");
}
/**
@@ -1571,11 +1572,11 @@ function hideDisclosablePasswordField(item) {
* @param {string} item The ID of the field to be copied
*/
function copyDisclosablePasswordFieldToClipboard(item) {
- const is_password_input = $("#" + item).prop("type") === "password";
+ const is_password_input = $("#" + CSS.escape(item)).prop("type") === "password";
if (is_password_input) {
showDisclosablePasswordField(item);
}
- $("#" + item).select();
+ $("#" + CSS.escape(item)).select();
try {
document.execCommand("copy");
} catch {
@@ -1591,7 +1592,7 @@ function copyDisclosablePasswordFieldToClipboard(item) {
* @param element_id The ID of the table to be converted
*/
function initSortableTable(element_id) {
- const element = $(`#${element_id}`);
+ const element = $(`#${CSS.escape(element_id)}`);
const sort_table = (column_index) => {
const current_sort = element.data('sort');
element.data('sort', column_index);
@@ -1700,7 +1701,7 @@ if (typeof GlpiCommonAjaxController == "function") {
function setupAjaxDropdown(config) {
// Field ID is used as a selector, so we need to escape special characters
// to avoid issues with jQuery.
- const field_id = $.escapeSelector(config.field_id);
+ const field_id = CSS.escape(config.field_id);
const select2_el = $('#' + field_id).select2({
containerCssClass: config.container_css_class,
@@ -1796,7 +1797,7 @@ function setupAjaxDropdown(config) {
$('label[for=' + field_id + ']').on('click', function () { $('#' + field_id).select2('open'); });
$('#' + field_id).on('select2:open', function (e) {
- const search_input = document.querySelector(`.select2-search__field[aria-controls='select2-${e.target.id}-results']`);
+ const search_input = document.querySelector(`.select2-search__field[aria-controls='select2-${CSS.escape(e.target.id)}-results']`);
if (search_input) {
search_input.focus();
}
@@ -1809,7 +1810,7 @@ function setupAdaptDropdown(config)
{
// Field ID is used as a selector, so we need to escape special characters
// to avoid issues with jQuery.
- const field_id = $.escapeSelector(config.field_id);
+ const field_id = CSS.escape(config.field_id);
const options = {
width: config.width,
@@ -1909,8 +1910,8 @@ function setupAdaptDropdown(config)
$('label[for=' + field_id + ']').on('click', function () {
$('#' + field_id).select2('open');
});
- $('#' + field_id).on('select2:open', function () {
- const search_input = document.querySelector(`.select2-search__field[aria-controls='select2-\${e.target.id}-results']`);
+ $('#' + field_id).on('select2:open', function (e) {
+ const search_input = document.querySelector(`.select2-search__field[aria-controls='select2-${CSS.escape(e.target.id)}-results']`);
if (search_input) {
search_input.focus();
}
diff --git a/js/fileupload.js b/js/fileupload.js
index 895090e6740..c5e82813253 100644
--- a/js/fileupload.js
+++ b/js/fileupload.js
@@ -43,7 +43,7 @@ function uploadFile(file, editor) {
// Search for fileupload container.
// First try to find an uplaoder having same name as editor element.
- var uploader = $(`[data-uploader-name="${editor.getElement().name}"]`);
+ var uploader = $(`[data-uploader-name="${CSS.escape(editor.getElement().name)}"]`);
if (uploader.length === 0) {
// Fallback to uploader using default name
uploader = $(editor.getElement()).closest('form').find('[data-uploader-name="filename"]');
@@ -81,7 +81,7 @@ var handleUploadedFile = function (files, files_data, input_name, container, edi
editor = tinyMCE.get(editor_id);
const uploaded_image = uploaded_images.find((entry) => entry.filename === file.name);
const matching_image = uploaded_image !== undefined
- ? editor.dom.select(`img[data-upload_id="${uploaded_image.upload_id}"]`)
+ ? editor.dom.select(`img[data-upload_id="${CSS.escape(uploaded_image.upload_id)}"]`)
: [];
if (matching_image.length > 0) {
editor.dom.setAttrib(matching_image, 'id', tag_data.tag.replace(/#/g, ''));
@@ -123,7 +123,7 @@ var handleUploadedFile = function (files, files_data, input_name, container, edi
* @param {Object} container The fileinfo container
*/
var displayUploadedFile = function(file, tag, editor, input_name, filecontainer) {
- var fileindex = $(`input[name^="_${input_name}["]`).length;
+ var fileindex = $(`input[name^="_${CSS.escape(input_name)}["]`).length;
var ext = file.name.split('.').pop();
var p = $('')
@@ -173,7 +173,7 @@ var displayUploadedFile = function(file, tag, editor, input_name, filecontainer)
var deleteImagePasted = function(elementsIdToRemove, tagToRemove, editor) {
// Remove file display lines
$.each(elementsIdToRemove, (index, element) => {
- $(`#${element}`).remove();
+ $(`#${CSS.escape(element)}`).remove();
});
if (typeof editor !== "undefined" && editor !== null
diff --git a/js/glpi_dialog.js b/js/glpi_dialog.js
index 0d34a28a71c..e5731cd971a 100644
--- a/js/glpi_dialog.js
+++ b/js/glpi_dialog.js
@@ -33,6 +33,7 @@
/* eslint no-var: 0 */
/* global bootstrap */
+/* global _ */
/**
* Create a dialog window
@@ -81,14 +82,14 @@ var glpi_html_dialog = function({
var bclass = ("class" in button) ? button.class : 'btn-secondary';
buttons_html+= `
-