diff --git a/app/Http/Kernel.php b/app/Http/Kernel.php index 70e4bd1..0171caf 100644 --- a/app/Http/Kernel.php +++ b/app/Http/Kernel.php @@ -37,7 +37,7 @@ class Kernel extends HttpKernel \App\Http\Middleware\VerifyCsrfToken::class, \Illuminate\Routing\Middleware\SubstituteBindings::class, \App\Http\Middleware\SecureHeaders::class, - 'xss' + 'htmlsanitize' ] ]; @@ -59,6 +59,6 @@ class Kernel extends HttpKernel 'signed' => \Illuminate\Routing\Middleware\ValidateSignature::class, 'throttle' => \Illuminate\Routing\Middleware\ThrottleRequests::class, 'verified' => \Illuminate\Auth\Middleware\EnsureEmailIsVerified::class, - 'xss' => \App\Http\Middleware\XssSanitizer::class, + 'htmlsanitize' => \App\Http\Middleware\HtmlSanitizer::class, ]; } diff --git a/app/Http/Middleware/XssSanitizer.php b/app/Http/Middleware/HtmlSanitizer.php similarity index 73% rename from app/Http/Middleware/XssSanitizer.php rename to app/Http/Middleware/HtmlSanitizer.php index 955d285..4b964ba 100644 --- a/app/Http/Middleware/XssSanitizer.php +++ b/app/Http/Middleware/HtmlSanitizer.php @@ -5,7 +5,7 @@ namespace App\Http\Middleware; use App\Lib\ToolboxHelper; use Illuminate\Http\Request; -class XssSanitizer +class HtmlSanitizer { /** * Handle an incoming request. @@ -18,11 +18,17 @@ class XssSanitizer public function handle(Request $request, \Closure $next, ...$params) { $inputs = $request->all(); - array_walk_recursive($inputs, function (&$input, $name) use ($params) { + /** @var callable|null */ + $cleanInput = null; + $cleanInput = function (&$input, $name, $rootName = null) use ($params, &$cleanInput) { + // * Nested element array + if (is_array($input)) { + array_walk_recursive($input, $cleanInput, $name); + } if (!is_string($input)) { return; } - if (in_array($name, $params)) { + if (in_array($name, $params) or in_array($rootName ?? $name, $params)) { // ? Is a json input ? if ($isJson = \json_decode($input, true) and is_array($isJson)) { // ! Decode each json field recursive. @@ -39,7 +45,8 @@ class XssSanitizer } else { $input = strip_tags($input); } - }); + }; + \array_walk($inputs, $cleanInput); $request->merge($inputs); return $next($request); } diff --git a/routes/web.php b/routes/web.php index 8d4da25..c80e16e 100644 --- a/routes/web.php +++ b/routes/web.php @@ -79,11 +79,11 @@ Route::middleware('auth:web')->group(function () { Route::resource('labels', LabelController::class)->except('show'); Route::resource('brands', BrandController::class); Route::resource('sites', SiteController::class) - ->withoutMiddleware('xss') - ->middleware('xss:description,todo'); + ->withoutMiddleware('htmlsanitize') + ->middleware('htmlsanitize:description,todo'); Route::resource('projects', ProjectController::class) - ->withoutMiddleware('xss') - ->middleware('xss:description,todo'); + ->withoutMiddleware('htmlsanitize') + ->middleware('htmlsanitize:description,todo'); Route::resource('projects.macro_markers', MarkerController::class) ->parameters([ 'macro_markers' => 'marker' @@ -117,9 +117,13 @@ Route::middleware('auth:web')->group(function () { // * LOGS and Files Route::resource('logs', LogController::class)->only('index'); Route::resource('files', FileController::class)->only('index'); - Route::resource('projects.logs', LogController::class); + Route::resource('projects.logs', LogController::class) + ->withoutMiddleware('htmlsanitize') + ->middleware('htmlsanitize:entry'); Route::resource('projects.files', FileController::class); - Route::resource('sites.logs', LogController::class); + Route::resource('sites.logs', LogController::class) + ->withoutMiddleware('htmlsanitize') + ->middleware('htmlsanitize:entry'); Route::resource('sites.files', FileController::class); // * INVOICES