mirror/opensourcepos
1
0
Fork 0
mirror of https://github.com/opensourcepos/opensourcepos.git synced 2026-07-25 22:27:05 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): Escape theme variable in login page

Browse Source 
Escape configured language in settings page
This commit is contained in:
jekkos
2026-06-19 22:18:05 +02:00
parent 6342d4513a
commit 4335c1563e
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
app/Views/login.php
View File

@@ -32,7 +32,7 @@ $request = Services::request();
? 'flatly'
: $config['theme']);
?>
<link rel="stylesheet" href="resources/bootswatch5/<?= "$theme" ?>/bootstrap.min.css">
<link rel="stylesheet" href="resources/bootswatch5/<?= esc("$theme") ?>/bootstrap.min.css">
<link rel="stylesheet" href="css/login.css">
<meta name="theme-color" content="#2c3e50">
</head>

2
app/Views/partial/datepicker_locale.php
View File

@@ -25,7 +25,7 @@ var pickerconfig = function(config) {
}, <?php echo isset($config) ?>);
};
$.fn.datetimepicker.dates['<?= $config['language'] ?>'] = {
$.fn.datetimepicker.dates['<?= esc($config['language']) ?>'] = {
days: [
"<?= lang('Calendar.sunday') ?>",
"<?= lang('Calendar.monday') ?>",