Jakach/jakach-login
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fixing potentiall xss in external domains list
Deploy / deploy (push) Successful in 28s
Details

Browse Source
This commit is contained in:
janis steiner
2026-05-15 10:13:23 +02:00
parent eb3ffed163
commit 37cf88a06e
4 changed files with 85 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app-code/account/index.php
+48 -6
View File
@@ -818,8 +818,25 @@ function updatePasswordStrength() {
data.domains.forEach(d => {
const item = document.createElement('div');
item.className = 'list-group-item d-flex justify-content-between align-items-center';
item.innerHTML = '<span><strong>' + d.domain + '</strong><br><small class="text-muted">Approved: ' + d.confirmed_at + '</small></span>' +
'<button class="btn btn-sm btn-outline-danger" onclick="removeDomain(' + d.id + ')">Revoke</button>';
const details = document.createElement('span');
const domain = document.createElement('strong');
domain.textContent = d.domain;
const approvedAt = document.createElement('small');
approvedAt.className = 'text-muted';
approvedAt.textContent = 'Approved: ' + d.confirmed_at;
details.appendChild(domain);
details.appendChild(document.createElement('br'));
details.appendChild(approvedAt);
const revokeButton = document.createElement('button');
revokeButton.type = 'button';
revokeButton.className = 'btn btn-sm btn-outline-danger';
revokeButton.textContent = 'Revoke';
revokeButton.addEventListener('click', () => removeDomain(Number(d.id)));
item.appendChild(details);
item.appendChild(revokeButton);
list.appendChild(item);
});
});
@@ -881,9 +898,30 @@ function updatePasswordStrength() {
'sessions_revoked': 'Sessions revoked',
};
const label = actionLabels[e.action] || e.action;
item.innerHTML = '<div class="d-flex w-100 justify-content-between"><strong>' + label + '</strong><small class="text-muted">' + e.created_at + '</small></div>' +
'<small class="text-muted">' + (e.ip ? e.ip + ' &middot; ' : '') + (e.user_agent ? e.user_agent.substring(0, 60) + '...' : '') + '</small>' +
(e.details ? '<br><small>' + e.details + '</small>' : '');
const header = document.createElement('div');
header.className = 'd-flex w-100 justify-content-between';
const action = document.createElement('strong');
action.textContent = label;
const createdAt = document.createElement('small');
createdAt.className = 'text-muted';
createdAt.textContent = e.created_at;
header.appendChild(action);
header.appendChild(createdAt);
const metadata = document.createElement('small');
metadata.className = 'text-muted';
metadata.textContent = (e.ip ? e.ip + ' - ' : '') + (e.user_agent ? e.user_agent.substring(0, 60) + '...' : '');
item.appendChild(header);
item.appendChild(metadata);
if (e.details) {
const details = document.createElement('small');
details.textContent = e.details;
item.appendChild(document.createElement('br'));
item.appendChild(details);
}
list.appendChild(item);
});
});
@@ -904,7 +942,11 @@ function updatePasswordStrength() {
data.sessions.forEach(s => {
const item = document.createElement('div');
item.className = 'list-group-item d-flex justify-content-between align-items-center';
item.innerHTML = '<span><strong>' + (s.user_agent || 'Unknown device') + '</strong></span>';
const device = document.createElement('span');
const deviceName = document.createElement('strong');
deviceName.textContent = s.user_agent || 'Unknown device';
device.appendChild(deviceName);
item.appendChild(device);
list.appendChild(item);
});
});