DGNum/demarches-normaliennes
14
1
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity

Merge pull request #10696 from colinux/fix-xss-galery

Browse source 
Sécurité: évite une injection XSS par le nom des PJ qui trompait les navigateurs
This commit is contained in:
Colin Darie 2024-08-20 14:06:19 +00:00 committed by GitHub
commit f50d4948e4
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 6 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
app/components/dossiers/champs_rows_show_component/champs_rows_show_component.html.haml
View file

@ -23,7 +23,7 @@
- when TypeDeChamp.type_champs.fetch(:multiple_drop_down_list)
= render partial: "shared/champs/multiple_drop_down_list/show", locals: { champ: champ }
- when TypeDeChamp.type_champs.fetch(:piece_justificative), TypeDeChamp.type_champs.fetch(:titre_identite)
= render partial: "shared/champs/piece_justificative/show", locals: { champ: champ }
= render partial: "shared/champs/piece_justificative/show", locals: { champ: champ, profile: @profile }
- when TypeDeChamp.type_champs.fetch(:siret)
= render partial: "shared/champs/siret/show", locals: { champ: champ, profile: @profile }
- when TypeDeChamp.type_champs.fetch(:iban)

4
app/views/instructeurs/dossiers/pieces_jointes.html.haml
View file

@ -8,7 +8,7 @@
.gallery-item
- blob = attachment.blob
- if displayable_pdf?(blob)
= link_to blob.url, id: blob.id, data: { iframe: true, src: blob.url }, class: 'gallery-link', type: blob.content_type, title: "#{libelle} -- #{blob.filename}" do
= link_to blob.url, id: blob.id, data: { iframe: true, src: blob.url }, class: 'gallery-link', type: blob.content_type, title: "#{libelle} -- #{sanitize(blob.filename.to_s)}" do
.thumbnail
= image_tag(preview_url_for(attachment), loading: :lazy)
.fr-btn.fr-btn--tertiary.fr-btn--icon-left.fr-icon-eye{ role: :button }
@ -18,7 +18,7 @@
= render Attachment::ShowComponent.new(attachment: attachment, truncate: true)
- elsif displayable_image?(blob)
= link_to image_url(blob_url(attachment)), title: "#{libelle} -- #{blob.filename}", data: { src: blob.url }, class: 'gallery-link' do
= link_to image_url(blob_url(attachment)), title: "#{libelle} -- #{sanitize(blob.filename.to_s)}", data: { src: blob.url }, class: 'gallery-link' do
.thumbnail
= image_tag(variant_url_for(attachment), loading: :lazy)
.fr-btn.fr-btn--tertiary.fr-btn--icon-left.fr-icon-eye{ role: :button }

6
app/views/shared/champs/piece_justificative/_show.html.haml
View file

@ -1,18 +1,18 @@
.fr-downloads-group
- if instructeur_signed_in? && feature_enabled?(:gallery_demande)
- if profile == 'instructeur' && feature_enabled?(:gallery_demande)
.gallery-items-list
- champ.piece_justificative_file.attachments.with_all_variant_records.each do |attachment|
.gallery-item
- blob = attachment.blob
- if displayable_pdf?(blob)
= link_to blob.url, id: blob.id, data: { iframe: true, src: blob.url }, class: 'gallery-link', type: blob.content_type, title: "#{champ.libelle} -- #{blob.filename}" do
= link_to blob.url, id: blob.id, data: { iframe: true, src: blob.url }, class: 'gallery-link', type: blob.content_type, title: "#{champ.libelle} -- #{sanitize(blob.filename.to_s)}" do
.thumbnail
= image_tag(preview_url_for(attachment), loading: :lazy)
.fr-btn.fr-btn--tertiary.fr-btn--icon-left.fr-icon-eye{ role: :button }
= 'Visualiser'
- elsif displayable_image?(blob)
= link_to image_url(blob_url(attachment)), title: "#{champ.libelle} -- #{blob.filename}", data: { src: blob.url }, class: 'gallery-link' do
= link_to image_url(blob_url(attachment)), title: "#{champ.libelle} -- #{sanitize(blob.filename.to_s)}", data: { src: blob.url }, class: 'gallery-link' do
.thumbnail
= image_tag(variant_url_for(attachment), loading: :lazy)
.fr-btn.fr-btn--tertiary.fr-btn--icon-left.fr-icon-eye{ role: :button }