Skip to content

Commit e36a94b

Browse files
committed
additional newline sanitizing of the server side json feed before it gets eval'd, in addition to the checks already present in the freemarker output. possibly addresses issue #82.
git-svn-id: https://share-extras.googlecode.com/svn/trunk/Audit Dashlet@1219 a3f5c567-fd0f-3a89-9b71-a290c5a5f590
1 parent 5ea5126 commit e36a94b

File tree

1 file changed

+6
-2
lines changed

1 file changed

+6
-2
lines changed

config/alfresco/site-webscripts/org/sharextras/components/dashlets/audit-application-data.get.js

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,8 +42,12 @@ function main()
4242
var requoted_response = rawresponse.replace(requoting_regex, ":\"$1\",");
4343
//if(logger.isLoggingEnabled()) logger.log("requoted_response:\n"+requoted_response);
4444

45-
var auditresponse = eval("(" + requoted_response + ")");
46-
model.auditresponse = auditresponse;
45+
// replace with as space spurious newlines that could have been stored in a json item, before the feed gets eval'd. see also ALF-11190.
46+
var escaped_response = requoted_response.replace(/(\n|\r\n|\r)/g, " ");
47+
//if(logger.isLoggingEnabled()) logger.log("escaped_response:\n"+escaped_response);
48+
49+
var auditresponse = eval("(" + escaped_response + ")");
50+
model.auditresponse = auditresponse;
4751
model.jsonResp = result.response;
4852
}
4953

0 commit comments

Comments
 (0)