fixed xss issue at datagrid

naresh verma · naresh verma · commit 882dc2e7e7e9 · 2021-09-14T20:16:14.000+05:30
diff --git a/packages/Webkul/UI/publishable/assets/js/ui.js b/packages/Webkul/UI/publishable/assets/js/ui.js
diff --git a/packages/Webkul/UI/publishable/assets/mix-manifest.json b/packages/Webkul/UI/publishable/assets/mix-manifest.json
@@ -1,5 +1,5 @@
 {
-    "/js/ui.js": "/js/ui.js?id=04e2fdebe8621c6953e2",
+    "/js/ui.js": "/js/ui.js?id=42bdc4ac52e1762101c3",
     "/css/ui.css": "/css/ui.css?id=58acb02c87af96127d4b",
     "/images/add-icon.svg": "/images/add-icon.svg?id=9135b4e0e1c239c36981",
     "/images/align-justify-icon.svg": "/images/align-justify-icon.svg?id=ee8d48e636b80417a884",
diff --git a/packages/Webkul/UI/src/Resources/assets/js/components/datagrid/table-body.vue b/packages/Webkul/UI/src/Resources/assets/js/components/datagrid/table-body.vue
@@ -36,7 +36,7 @@
                         :key="rowIndex"
                         v-if="column.type != 'hidden'"
                         @click="redirectRow(row.redirect_url)"
-                        v-html="getRowContent(row[column.index])"
+                        v-text="getRowContent(row[column.index])"
                         :title="column.title ? row[column.index] : ''"
                         :class="[row.redirect_url ? 'cursor-pointer' : '', column.class || column.index ]"
                     ></td>
@@ -174,7 +174,7 @@
                                     type    : "success",
                                     message : response.data.message,
                                 });
-    
+
                                 EventBus.$emit('refresh_table_data', {usePrevious: true});
                             }
                         }
@@ -189,4 +189,4 @@
             }
         }
     };
-</script>
+</script>

Original file line number	Diff line number	Diff line change
`@@ -1,5 +1,5 @@`
`1`	`1`	`{`
`2`		`- "/js/ui.js": "/js/ui.js?id=04e2fdebe8621c6953e2",`
	`2`	`+ "/js/ui.js": "/js/ui.js?id=42bdc4ac52e1762101c3",`
`3`	`3`	`"/css/ui.css": "/css/ui.css?id=58acb02c87af96127d4b",`
`4`	`4`	`"/images/add-icon.svg": "/images/add-icon.svg?id=9135b4e0e1c239c36981",`
`5`	`5`	`"/images/align-justify-icon.svg": "/images/align-justify-icon.svg?id=ee8d48e636b80417a884",`
Original file line number	Diff line number	Diff line change
`@@ -36,7 +36,7 @@`
`36`	`36`	`:key="rowIndex"`
`37`	`37`	`v-if="column.type != 'hidden'"`
`38`	`38`	`@click="redirectRow(row.redirect_url)"`
`39`		`- v-html="getRowContent(row[column.index])"`
	`39`	`+ v-text="getRowContent(row[column.index])"`
`40`	`40`	`:title="column.title ? row[column.index] : ''"`
`41`	`41`	`:class="[row.redirect_url ? 'cursor-pointer' : '', column.class \|\| column.index ]"`
`42`	`42`	`></td>`
`@@ -174,7 +174,7 @@`
`174`	`174`	`type : "success",`
`175`	`175`	`message : response.data.message,`
`176`	`176`	`});`
`177`		`-`
	`177`	`+`
`178`	`178`	`EventBus.$emit('refresh_table_data', {usePrevious: true});`
`179`	`179`	`}`
`180`	`180`	`}`
`@@ -189,4 +189,4 @@`
`189`	`189`	`}`
`190`	`190`	`}`
`191`	`191`	`};`
`192`		`-</script>`
	`192`	`+</script>`