chiu/Application_Form
1
0 Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix vulnerable.

Browse Source
This commit is contained in:
bohung committed 2022-10-24 16:34:14 +08:00
1 parent 10cb149fc7
commit d86eb185dc
9 files changed
+59 -50
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

app/views/admin/application_form_review_results/edit.html.erb
+8 -7
View File
@@ -42,7 +42,7 @@
<% val = t("application_form.registration_status_#{application_form_signup.status}") if !application_form_signup.status.blank? %>
<% end %>
<% elsif names[0] == "application_form_signup_field_custom" || names[0] == "application_form_signup_fields" %>
<% val = application_form_signup.application_form_signup_values.where(:key=>names[1]).first.get_value_by_locale(I18n.locale) rescue "" %>
<% val = html_escape(application_form_signup.application_form_signup_values.where(:key=>names[1]).first.get_value_by_locale(I18n.locale)).gsub(/(\r\n|\n)/,"<br>") rescue "" %>
<% elsif names[0] == "application_form_signup_contributes" %>
<% if names[1] == "file" %>
<% application_form_signup_contribute = @application_form_signup_contribute %>
@@ -68,7 +68,7 @@
<% else %>
<% file_content = File.read(file_path) rescue "" %>
<% if file_content.is_utf8? %>
<% file_content = file_content.gsub(/(\r\n|\n)/,"<br>")%>
<% file_content = html_escape(file_content).gsub(/(\r\n|\n)/,"<br>") %>
<% val = "<div class=\"text_wrap\"><a class=\"pull-right\" href=\"#{file_url}\" title=\"#{t(:download)}\">#{t(:download)}</a><div style=\"clear: both;\"></div><h4>#{file_title}</h4>#{file_content}</div>"%>
<% else %>
<% val = link_to( file_title, file_url , {:target => '_blank', :title => Nokogiri::HTML(description.gsub("<br>"," , ")).text} ) if application_form_signup_contribute.file.file %>
@@ -90,12 +90,13 @@
<% end %>
<% end %>
<% elsif names[0] == "application_form_submission_fields" %>
<% val = @application_form_signup_contribute.application_form_submission_values.where(:key=>names[1]).first.get_value_by_locale(I18n.locale) rescue "" %>
<% application_form_submission_field = application_form_signup.application_form_main.application_form_submission_fields.where(:key=>names[1]).first %>
<% if application_form_submission_field && application_form_submission_field.markup == "application_form_preferred_session"
application_form_submission_value = @application_form_signup_contribute.application_form_submission_values.where(:key=>names[1]).first
val = "<span data-id=\"#{application_form_submission_value.id rescue ''}\">#{(application_form_submission_value.get_value_by_locale(I18n.locale) rescue "")}</span>"
end %>
<% if application_form_submission_field && application_form_submission_field.markup == "application_form_preferred_session"
application_form_submission_value = @application_form_signup_contribute.application_form_submission_values.where(:key=>names[1]).first
val = "<span data-id=\"#{application_form_submission_value.id rescue ''}\">#{(html_escape(application_form_submission_value.get_value_by_locale(I18n.locale)).gsub(/(\r\n|\n)/,"<br>") rescue "")}</span>"
else
val = html_escape(@application_form_signup_contribute.application_form_submission_values.where(:key=>names[1]).first.get_value_by_locale(I18n.locale).gsub('<br>', "\n")).gsub("\n","<br>") rescue ""
end %>
<% elsif names[0] == "application_form_signup" %>
<% val = (application_form_signup.send("display_"+names[1]) rescue application_form_signup.send(names[1])) rescue nil %>
<% elsif names[0] == "application_form_review_result" %>
app/views/admin/application_form_signups/edit.html.erb
-8
View File
@@ -163,14 +163,6 @@
<%= f.email_field :email, :class=>"input-block-level", :placeholder=> t(:email), :required => true %> <a href="#" onclick="window.open(' <%= OrbitHelper.url_to_show(@application_form.to_param) %>?method=check_email&no=<%=@application_form.id%>&layout=false&email='+ $('input[type=email]').val() , 'check mail', config='height=100,width=300');" class="btn btn-primary">check mail</a>
</div>
</div>
<div class="control-group <%= @application_form.registration_status[0] == 'C' ? '' : 'hide' %>" id="registration_status">
<label for="password" class="control-label muted">*<%= t('application_form_signup.password') %></label>
<div class="controls">
<%= f.text_field :password, :class=>"input-block-level", :placeholder=> t('application_form_signup.password') %>
<%= t('application_form_signup.password_message') %>
</div>
</div>
<% end %>
<% @form_index = 0 %>
app/views/admin/application_forms/_application_form_signup_render_table.html.erb
+11 -10
View File
@@ -81,7 +81,7 @@
<% val = t("application_form.registration_status_#{application_form_signup.status}") if !application_form_signup.status.blank? %>
<% end %>
<% elsif names[0] == "application_form_signup_field_custom" || names[0] == "application_form_signup_fields" %>
<% val = application_form_signup.application_form_signup_values.where(:key=>names[1]).first.get_value_by_locale(I18n.locale) rescue "" %>
<% val = html_escape(application_form_signup.application_form_signup_values.where(:key=>names[1]).first.get_value_by_locale(I18n.locale)).gsub(/(\r\n|\n)/,"<br>") rescue "" %>
<% elsif names[0] == "application_form_signup_contributes" %>
<% if names[1] == "file" %>
<% val = application_form_signup_contributes %>
@@ -103,16 +103,17 @@
<% end %>
<% end %>
<% elsif names[0] == "application_form_submission_fields" %>
<% val = application_form_signup_contributes.collect{|s| (s.application_form_submission_values.where(:key=>names[1]).first.get_value_by_locale(I18n.locale) rescue "")} %>
<% application_form_submission_field = application_form_signup.application_form_main.application_form_submission_fields.where(:key=>names[1]).first %>
<% if application_form_submission_field && application_form_submission_field.markup == "application_form_preferred_session"
val = application_form_signup_contributes.collect{|s|
application_form_submission_value = s.application_form_submission_values.where(:key=>names[1]).first
"<span data-id=\"#{application_form_submission_value.id rescue ''}\">#{(application_form_submission_value.get_value_by_locale(I18n.locale) rescue "")}</span>"}
edit_urls[i] = []
application_form_submission_values = application_form_signup_contributes.collect{|s| s.application_form_submission_values.where(:key=>names[1]).first }
edit_urls[i] = application_form_submission_values.map{|application_form_submission_value| edit_admin_application_form_submission_value_path(application_form_submission_value.id) rescue "#"}
end %>
<% if application_form_submission_field && application_form_submission_field.markup == "application_form_preferred_session"
val = application_form_signup_contributes.collect{|s|
application_form_submission_value = s.application_form_submission_values.where(:key=>names[1]).first
"<span data-id=\"#{application_form_submission_value.id rescue ''}\">#{(html_escape(application_form_submission_value.get_value_by_locale(I18n.locale)).gsub(/(\r\n|\n)/,"<br>") rescue "")}</span>"}
edit_urls[i] = []
application_form_submission_values = application_form_signup_contributes.collect{|s| s.application_form_submission_values.where(:key=>names[1]).first }
edit_urls[i] = application_form_submission_values.map{|application_form_submission_value| edit_admin_application_form_submission_value_path(application_form_submission_value.id) rescue nil}
else
val = application_form_signup_contributes.collect{|s| (html_escape(s.application_form_submission_values.where(:key=>names[1]).first.get_value_by_locale(I18n.locale)).gsub(/(\r\n|\n)/,"<br>") rescue "")}
end %>
<% elsif names[0] == "application_form_signup" %>
<% val = (application_form_signup.send("display_"+names[1]) rescue application_form_signup.send(names[1])) rescue nil %>
<% val = val.strftime('%Y/%m/%d %H:%M') if names[1] == 'created_at' %>
app/views/admin/application_forms/_application_form_signup_session_dashboard.html.erb
+1 -1
View File
@@ -27,7 +27,7 @@
content_tag :div, paginate(@application_form_signups), class: "pagination pagination-centered"
end
%>
<%= pagination_html.gsub(/page_no#{count}=\d*/,"").gsub('&&','&').gsub(/page=(\d*)/m){|ff| ff.gsub("page=#{$1}","page=#{params[:page]}&page_no#{count}=#{$1}")}.html_safe %>
<%= pagination_html.gsub(/page_no#{count}=\d*/,"").gsub('&&','&').gsub(/page=(\d*)/m){|ff| ff.gsub("page=#{$1}","page=#{(params[:page] ? params[:page].to_s.to_i : nil)}&page_no#{count}=#{$1}")}.html_safe %>
</div>
<% end %>
<% if count != 2 && @application_form.summary_chioices.count >= 2 %>
app/views/admin/application_forms/_get_display_fields.html.erb
+6 -3
View File
@@ -69,9 +69,12 @@
<% application_form_signup_field_sets = ApplicationFormSignupFieldSet.all.uniq{|s| s.field_name} %>
<% if application_form_signup_field_sets.count != 0 %>
<% application_form_signup_field_sets.each do |field_set| %>
<% next if ApplicationFormMain::ExceptFieldSetDisplays.include?(field_set) %>
<% default_show << "application_form_signup_field_set.#{field_set.field_name}" if !(field_set.hidden) %>
<% @field_names << "application_form_signup_field_set.#{field_set.field_name}" %>
<%
field_name = field_set.field_name
next if ApplicationFormMain::ExceptFieldSetDisplays.include?(field_name)
%>
<% default_show << "application_form_signup_field_set.#{field_name}" if !(field_set.hidden) %>
<% @field_names << "application_form_signup_field_set.#{field_name}" %>
<% @field_name_translations << field_set.name[I18n.locale] %>
<% end %>
<% else %>