mirror of
https://github.com/FOSSBilling/FOSSBilling.git
synced 2026-11-03 02:27:21 +09:00
Adam Daley
6a967c6963
* Sanitize support ticket note content Note content arrived through the note_create endpoint and was stored as provided, then rendered in the admin ticket list dialog with innerHTML. Sanitize new notes as plain text on the way in (matching how canned response titles are stored), and render the dialog entries with a text node instead of innerHTML so previously stored content cannot inject markup either. Preserve line breaks while rendering the dialog entries. * Preview massmailer messages in a sandboxed frame The message preview injected the rendered message body straight into the admin page with innerHTML, so a message written by one staff member would run script in the browser of another staff member previewing it. Render the body in a sandboxed iframe instead, using the same posture as the email template preview, and assign srcdoc as a property so the body is never parsed in the page context. * Reject support ticket notes that are empty after sanitization A note whose content is entirely markup survived RequiredParams (which only checks that the parameter exists) and, now that note content is sanitized to plain text on storage, would be persisted as an empty row. Return a validation error instead.