beenull/ctrlpanel
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

Merge pull request #422 from ControlPanel-gg/development

Browse source 
Fixed JS Exploit
This commit is contained in:
Dennis 2022-04-20 12:31:46 +02:00 committed by GitHub
parent 0eb63c8541 39af09b521
commit 0e426dca62
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
5 changed files with 5 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
app/Http/Controllers/Admin/ServerController.php
View file

@ -163,7 +163,7 @@ class ServerController extends Controller
return $server->suspended ? $server->suspended->diffForHumans() : '';
})
->editColumn('name', function (Server $server) {
return '<a class="text-info" target="_blank" href="' . config("SETTINGS::SYSTEM:PTERODACTYL:URL") . '/admin/servers/view/' . $server->pterodactyl_id . '">' . $server->name . '</a>';
return '<a class="text-info" target="_blank" href="' . config("SETTINGS::SYSTEM:PTERODACTYL:URL") . '/admin/servers/view/' . $server->pterodactyl_id . '">' . strip_tags($server->name) . '</a>';
})
->rawColumns(['user', 'actions', 'status', 'name'])
->make();

2
app/Http/Controllers/Admin/UserController.php
View file

@ -302,7 +302,7 @@ class UserController extends Controller
return '<span class="badge ' . $badgeColor . '">' . $user->role . '</span>';
})
->editColumn('name', function (User $user) {
return '<a class="text-info" target="_blank" href="' . config("SETTINGS::SYSTEM:PTERODACTYL:URL") . '/admin/users/view/' . $user->pterodactyl_id . '">' . $user->name . '</a>';
return '<a class="text-info" target="_blank" href="' . config("SETTINGS::SYSTEM:PTERODACTYL:URL") . '/admin/users/view/' . $user->pterodactyl_id . '">' . strip_tags($user->name) . '</a>';
})
->orderColumn('last_seen', function ($query, $order) {
$query->orderBy('last_seen', $order);

2
config/app.php
View file

@ -4,7 +4,7 @@ use App\Models\Settings;
return [
'version' => '0.7.3',
'version' => '0.7.4',
/*
|--------------------------------------------------------------------------

2
resources/views/admin/products/create.blade.php
View file

@ -63,7 +63,7 @@
</div>
<div class="form-group">
<label for="price">{{__('Price in')}}{{CREDITS_DISPLAY_NAME}}</label>
<label for="price">{{__('Price in')}} {{CREDITS_DISPLAY_NAME}}</label>
<input value="{{$product->price ?? old('price')}}" id="price" name="price"
type="number"
class="form-control @error('price') is-invalid @enderror"

2
resources/views/admin/users/index.blade.php
View file

@ -79,7 +79,7 @@
serverSide: true,
stateSave: true,
ajax: "{{route('admin.users.datatable')}}",
order: [[ 11, "desc" ]],
order: [[ 10, "desc" ]],
columns: [
{data: 'discordId', visible: false, name: 'discordUser.id'},
{data: 'pterodactyl_id', visible: false},