From fd049309f361f765f69d4dd65c081498f84589ac Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Munsch?= Date: Thu, 29 Sep 2022 13:02:18 +0200 Subject: [PATCH 1/2] Ticket 1076 : Fix ticket Sync labels --- app/Http/Controllers/TicketController.php | 5 ++--- app/Http/Requests/StoreTicket.php | 3 +++ 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/app/Http/Controllers/TicketController.php b/app/Http/Controllers/TicketController.php index 5d61059..e74431f 100644 --- a/app/Http/Controllers/TicketController.php +++ b/app/Http/Controllers/TicketController.php @@ -264,9 +264,8 @@ class TicketController extends Controller $ticket->file2 = ToolboxHelper::storeImage($ticket->getTable(), $fileTicket2); } - if ($request->labels) { - $ticket->labels()->sync($request->labels); - } + + $ticket->labels()->sync($request->labels); $ticket->site()->associate($site); $ticket->saveOrFail(); diff --git a/app/Http/Requests/StoreTicket.php b/app/Http/Requests/StoreTicket.php index 96b2ead..79c895c 100644 --- a/app/Http/Requests/StoreTicket.php +++ b/app/Http/Requests/StoreTicket.php @@ -40,6 +40,9 @@ class StoreTicket extends FormRequest ]); } } + $this->merge([ + 'labels' => $this->labels ?? [] + ]); } From 0b99ed53092f976bf4a8b803406b806a95dd5bca Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Munsch?= Date: Thu, 29 Sep 2022 14:39:20 +0200 Subject: [PATCH 2/2] Ticket 975 Upgrade HtmlSanitizer, Add missing middleware parameters on sites.logs and projects.log resources routes --- app/Http/Kernel.php | 4 ++-- .../{XssSanitizer.php => HtmlSanitizer.php} | 15 +++++++++++---- routes/web.php | 16 ++++++++++------ 3 files changed, 23 insertions(+), 12 deletions(-) rename app/Http/Middleware/{XssSanitizer.php => HtmlSanitizer.php} (73%) diff --git a/app/Http/Kernel.php b/app/Http/Kernel.php index 70e4bd1..0171caf 100644 --- a/app/Http/Kernel.php +++ b/app/Http/Kernel.php @@ -37,7 +37,7 @@ class Kernel extends HttpKernel \App\Http\Middleware\VerifyCsrfToken::class, \Illuminate\Routing\Middleware\SubstituteBindings::class, \App\Http\Middleware\SecureHeaders::class, - 'xss' + 'htmlsanitize' ] ]; @@ -59,6 +59,6 @@ class Kernel extends HttpKernel 'signed' => \Illuminate\Routing\Middleware\ValidateSignature::class, 'throttle' => \Illuminate\Routing\Middleware\ThrottleRequests::class, 'verified' => \Illuminate\Auth\Middleware\EnsureEmailIsVerified::class, - 'xss' => \App\Http\Middleware\XssSanitizer::class, + 'htmlsanitize' => \App\Http\Middleware\HtmlSanitizer::class, ]; } diff --git a/app/Http/Middleware/XssSanitizer.php b/app/Http/Middleware/HtmlSanitizer.php similarity index 73% rename from app/Http/Middleware/XssSanitizer.php rename to app/Http/Middleware/HtmlSanitizer.php index 955d285..4b964ba 100644 --- a/app/Http/Middleware/XssSanitizer.php +++ b/app/Http/Middleware/HtmlSanitizer.php @@ -5,7 +5,7 @@ namespace App\Http\Middleware; use App\Lib\ToolboxHelper; use Illuminate\Http\Request; -class XssSanitizer +class HtmlSanitizer { /** * Handle an incoming request. @@ -18,11 +18,17 @@ class XssSanitizer public function handle(Request $request, \Closure $next, ...$params) { $inputs = $request->all(); - array_walk_recursive($inputs, function (&$input, $name) use ($params) { + /** @var callable|null */ + $cleanInput = null; + $cleanInput = function (&$input, $name, $rootName = null) use ($params, &$cleanInput) { + // * Nested element array + if (is_array($input)) { + array_walk_recursive($input, $cleanInput, $name); + } if (!is_string($input)) { return; } - if (in_array($name, $params)) { + if (in_array($name, $params) or in_array($rootName ?? $name, $params)) { // ? Is a json input ? if ($isJson = \json_decode($input, true) and is_array($isJson)) { // ! Decode each json field recursive. @@ -39,7 +45,8 @@ class XssSanitizer } else { $input = strip_tags($input); } - }); + }; + \array_walk($inputs, $cleanInput); $request->merge($inputs); return $next($request); } diff --git a/routes/web.php b/routes/web.php index 8d4da25..c80e16e 100644 --- a/routes/web.php +++ b/routes/web.php @@ -79,11 +79,11 @@ Route::middleware('auth:web')->group(function () { Route::resource('labels', LabelController::class)->except('show'); Route::resource('brands', BrandController::class); Route::resource('sites', SiteController::class) - ->withoutMiddleware('xss') - ->middleware('xss:description,todo'); + ->withoutMiddleware('htmlsanitize') + ->middleware('htmlsanitize:description,todo'); Route::resource('projects', ProjectController::class) - ->withoutMiddleware('xss') - ->middleware('xss:description,todo'); + ->withoutMiddleware('htmlsanitize') + ->middleware('htmlsanitize:description,todo'); Route::resource('projects.macro_markers', MarkerController::class) ->parameters([ 'macro_markers' => 'marker' @@ -117,9 +117,13 @@ Route::middleware('auth:web')->group(function () { // * LOGS and Files Route::resource('logs', LogController::class)->only('index'); Route::resource('files', FileController::class)->only('index'); - Route::resource('projects.logs', LogController::class); + Route::resource('projects.logs', LogController::class) + ->withoutMiddleware('htmlsanitize') + ->middleware('htmlsanitize:entry'); Route::resource('projects.files', FileController::class); - Route::resource('sites.logs', LogController::class); + Route::resource('sites.logs', LogController::class) + ->withoutMiddleware('htmlsanitize') + ->middleware('htmlsanitize:entry'); Route::resource('sites.files', FileController::class); // * INVOICES