gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Escape config-form's action attribute

Browse Source 
Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
This commit is contained in:
Maurício Meneghini Fauth 2022-01-13 10:34:47 -03:00
parent 7dde0d019f
commit 5118acce1d
No known key found for this signature in database
GPG Key ID: 6A16FD38AFC89CC8
3 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
templates/config/form_display/form_top.twig
View File

@ -1,4 +1,4 @@
<form method="{{ method }}" action="{{ action|raw }}" class="config-form disableAjax">
<form method="{{ method }}" action="{{ action|e('html_attr') }}" class="config-form disableAjax">
<input type="hidden" name="tab_hash" value="">
{% if has_check_page_refresh %}
<input type="hidden" name="check_page_refresh" id="check_page_refresh" value="">

6
test/classes/Config/FormDisplayTemplateTest.php
View File

@ -38,13 +38,13 @@ class FormDisplayTemplateTest extends AbstractTestCase
*/
public function testDisplayFormTop(): void
{
$_SERVER['REQUEST_URI'] = 'https://www.phpmyadmin.net';
$_SERVER['REQUEST_URI'] = 'https://www.phpmyadmin.net/index.php?key=value&key2=">value2';
$GLOBALS['cfg']['ServerDefault'] = '';
$result = $this->formDisplayTemplate->displayFormTop(null, 'posted', [1]);
$this->assertStringContainsString(
'<form method="get" action="https://www.phpmyadmin.net" ' .
'class="config-form disableAjax">',
'<form method="get" action="https&#x3A;&#x2F;&#x2F;www.phpmyadmin.net&#x2F;'
. 'index.php&#x3F;key&#x3D;value&amp;key2&#x3D;&quot;&gt;value2" class="config-form disableAjax">',
$result
);

2
test/classes/Config/PageSettingsTest.php
View File

@ -54,7 +54,7 @@ class PageSettingsTest extends AbstractTestCase
'<div id="page_settings_modal">'
. '<div class="page_settings">'
. '<form method="post" '
. 'action="index.php?db=db&server=1&lang=en" '
. 'action="index.php&#x3F;db&#x3D;db&amp;server&#x3D;1&amp;lang&#x3D;en" '
. 'class="config-form disableAjax">',
$html
);