fix/[de,pe,de]: xss

ONLYOFFICE · Sep 18, 2024 · 5e43885 · 5e43885
1 parent 39197ed
commit 5e43885
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 6 deletions.
diff --git a/apps/documenteditor/main/app/view/FileMenuPanels.js b/apps/documenteditor/main/app/view/FileMenuPanels.js
@@ -1962,9 +1962,9 @@ define([], function () {
             }
 
             return '<tr data-custom-property>' +
-                '<td class="left"><label>' + name + '</label></td>' +
+                '<td class="left"><label>' + Common.Utils.String.htmlEncode(name) + '</label></td>' +
                 '<td class="right"><div class="custom-property-wrapper">' +
-                '<input type="text" spellcheck="false" class="form-control" readonly style="width: 200px;" value="' + Common.Utils.String.htmlEncode(value) +'">' +
+                '<input type="text" spellcheck="false" class="form-control" readonly style="width: 200px;" value="' + value +'">' +
                 '<div class="tool close img-colored" data-hint="2" data-hint-direction="right" data-hint-offset="small"></div>' +
                 '</div></td></tr>';
         },

diff --git a/apps/presentationeditor/main/app/view/FileMenuPanels.js b/apps/presentationeditor/main/app/view/FileMenuPanels.js
@@ -1450,9 +1450,9 @@ define([], function () {
             }
 
             return '<tr data-custom-property>' +
-                '<td class="left"><label>' + name + '</label></td>' +
+                '<td class="left"><label>' + Common.Utils.String.htmlEncode(name) + '</label></td>' +
                 '<td class="right"><div class="custom-property-wrapper">' +
-                '<input type="text" spellcheck="false" class="form-control" readonly style="width: 200px;" value="' + Common.Utils.String.htmlEncode(value) +'">' +
+                '<input type="text" spellcheck="false" class="form-control" readonly style="width: 200px;" value="' + value +'">' +
                 '<div class="tool close img-colored" data-hint="2" data-hint-direction="right" data-hint-offset="small"></div>' +
                 '</div></td></tr>';
         },

diff --git a/apps/spreadsheeteditor/main/app/view/FileMenuPanels.js b/apps/spreadsheeteditor/main/app/view/FileMenuPanels.js
@@ -1960,9 +1960,9 @@ define([], function () {
             }
 
             return '<tr data-custom-property>' +
-                '<td class="left"><label>' + name + '</label></td>' +
+                '<td class="left"><label>' + Common.Utils.String.htmlEncode(name) + '</label></td>' +
                 '<td class="right"><div class="custom-property-wrapper">' +
-                '<input type="text" spellcheck="false" class="form-control" readonly style="width: 200px;" value="' + Common.Utils.String.htmlEncode(value) +'">' +
+                '<input type="text" spellcheck="false" class="form-control" readonly style="width: 200px;" value="' + value +'">' +
                 '<div class="tool close img-colored" data-hint="2" data-hint-direction="right" data-hint-offset="small"></div>' +
                 '</div></td></tr>';
         },