MightyPork/airsonic-custom
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fix a bunch of dom-based xss

Browse Source 
This should close #633
This commit is contained in:
jvoisin
2019-04-01 23:08:57 +02:00
parent 83882b18d9
commit d35834c0e7
4 changed files with 29 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
airsonic-main/src/main/webapp/WEB-INF/jsp/artistMain.jsp
+5 -5
View File
@@ -97,15 +97,15 @@
} else {
$("#starSong" + id).attr("src", "<spring:theme code='ratingOffImage'/>");
}
$("#rank" + id).html(i + 1);
$("#title" + id).html(song.title);
$("#rank" + id).text(i + 1);
$("#title" + id).text(song.title);
$("#title" + id).attr("title", song.title);
$("#album" + id).html(song.album);
$("#album" + id).text(song.album);
$("#album" + id).attr("title", song.album);
$("#albumUrl" + id).attr("href", "main.view?id=" + song.id);
$("#artist" + id).html(song.artist);
$("#artist" + id).text(song.artist);
$("#artist" + id).attr("title", song.artist);
$("#songDuration" + id).html(song.durationAsString);
$("#songDuration" + id).text(song.durationAsString);
// Note: show() method causes page to scroll to top.
$("#pattern" + id).css("display", "table-row");
airsonic-main/src/main/webapp/WEB-INF/jsp/playQueue.jsp
+12 -12
View File
@@ -429,7 +429,7 @@
}
if (songs.length == 0) {
$("#songCountAndDuration").html("");
$("#songCountAndDuration").text("");
$("#empty").show();
} else {
$("#songCountAndDuration").html(songs.length + " <fmt:message key="playlist2.songs"/> &ndash; " + playQueue.durationAsString);
@@ -447,7 +447,7 @@
var id = i + 1;
dwr.util.cloneNode("pattern", { idSuffix:id });
if ($("#trackNumber" + id)) {
$("#trackNumber" + id).html(song.trackNumber);
$("#trackNumber" + id).text(song.trackNumber);
}
if (song.starred) {
$("#starSong" + id).attr("src", "<spring:theme code='ratingOnImage'/>");
@@ -461,40 +461,40 @@
}
}
if ($("#title" + id)) {
$("#title" + id).html(song.title);
$("#title" + id).text(song.title);
$("#title" + id).attr("title", song.title);
}
if ($("#titleUrl" + id)) {
$("#titleUrl" + id).html(song.title);
$("#titleUrl" + id).text(song.title);
$("#titleUrl" + id).attr("title", song.title);
$("#titleUrl" + id).click(function () {onSkip(this.id.substring(8) - 1)});
}
if ($("#album" + id)) {
$("#album" + id).html(song.album);
$("#album" + id).text(song.album);
$("#album" + id).attr("title", song.album);
$("#albumUrl" + id).attr("href", song.albumUrl);
}
if ($("#artist" + id)) {
$("#artist" + id).html(song.artist);
$("#artist" + id).text(song.artist);
$("#artist" + id).attr("title", song.artist);
}
if ($("#genre" + id)) {
$("#genre" + id).html(song.genre);
$("#genre" + id).text(song.genre);
}
if ($("#year" + id)) {
$("#year" + id).html(song.year);
$("#year" + id).text(song.year);
}
if ($("#bitRate" + id)) {
$("#bitRate" + id).html(song.bitRate);
$("#bitRate" + id).text(song.bitRate);
}
if ($("#duration" + id)) {
$("#duration" + id).html(song.durationAsString);
$("#duration" + id).text(song.durationAsString);
}
if ($("#format" + id)) {
$("#format" + id).html(song.format);
$("#format" + id).text(song.format);
}
if ($("#fileSize" + id)) {
$("#fileSize" + id).html(song.fileSize);
$("#fileSize" + id).text(song.fileSize);
}
$("#pattern" + id).addClass((i % 2 == 0) ? "bgcolor1" : "bgcolor2");
airsonic-main/src/main/webapp/WEB-INF/jsp/playlist.jsp
+7 -7
View File
@@ -86,8 +86,8 @@
$("#empty").hide();
}
$("#songCount").html(playlist.fileCount);
$("#duration").html(playlist.durationAsString);
$("#songCount").text(playlist.fileCount);
$("#duration").text(playlist.durationAsString);
if (playlist.shared) {
$("#shared").html("<fmt:message key="playlist2.shared"/>");
@@ -113,15 +113,15 @@
if (!song.present) {
$("#missing" + id).show();
}
$("#index" + id).html(id);
$("#title" + id).html(song.title);
$("#index" + id).text(id);
$("#title" + id).text(song.title);
$("#title" + id).attr("title", song.title);
$("#album" + id).html(song.album);
$("#album" + id).text(song.album);
$("#album" + id).attr("title", song.album);
$("#albumUrl" + id).attr("href", "main.view?id=" + song.id);
$("#artist" + id).html(song.artist);
$("#artist" + id).text(song.artist);
$("#artist" + id).attr("title", song.artist);
$("#songDuration" + id).html(song.durationAsString);
$("#songDuration" + id).text(song.durationAsString);
// Note: show() method causes page to scroll to top.
$("#pattern" + id).css("display", "table-row");
airsonic-main/src/main/webapp/WEB-INF/jsp/videoPlayerCast.jsp
+5 -5
View File
@@ -602,11 +602,11 @@
};
CastPlayer.prototype.updateDebug = function () {
var debug = "<br>currentMediaOffset: " + this.currentMediaOffset + "<br>"
+ "currentMediaTime: " + this.currentMediaTime + "<br>"
+ "localPlayerState: " + this.localPlayerState + "<br>"
var debug = "\n" + this.currentMediaOffset + "\n"
+ "currentMediaTime: " + this.currentMediaTime + "\n"
+ "localPlayerState: " + this.localPlayerState + "\n"
+ "castPlayerState: " + this.castPlayerState;
$("#debug").html(debug);
$("#debug").text(debug);
};
/**
@@ -692,4 +692,4 @@
window.CastPlayer = CastPlayer;
})();
</script>
</script>