Release 2.53 (#5878)

assets/js/KimaiPlugin.js

@@ -96,6 +96,7 @@ export default class KimaiPlugin {
     }
 
     /**
+     * @deprecated use the plugin directly
      * @param {string} title
      * @returns {string}
      */

assets/js/forms/KimaiTeamForm.js

@@ -83,7 +83,7 @@ export default class KimaiTeamForm extends KimaiFormPlugin {
         prototype.dataset['widgetCounter'] = (++counter).toString();
 
         const temp = document.createElement('div');
-        temp.innerHTML = newWidget;
+        temp.innerHTML = ESCAPER.sanitize(newWidget);
         temp.querySelector('input[type=hidden]').value = option.value;
 
         const newNode = temp.firstElementChild;

assets/js/plugins/KimaiAPILink.js

@@ -74,9 +74,6 @@ export default class KimaiAPILink extends KimaiPlugin {
         const successHandle = () => {
             EVENTS.trigger(eventName);
             document.dispatchEvent(new CustomEvent('kimai.reloadedContent'));
-            if (attributes['msgSuccess'] !== undefined) {
-                ALERT.success(attributes['msgSuccess']);
-            }
         };
         const errorHandle = (error) => {
             let message = 'action.update.error';

assets/js/plugins/KimaiEscape.js

@@ -10,6 +10,7 @@
  */
 
 import KimaiPlugin from "../KimaiPlugin";
+import DOMPurify from "dompurify";
 
 export default class KimaiEscape extends KimaiPlugin {
 
@@ -26,14 +27,23 @@ export default class KimaiEscape extends KimaiPlugin {
             return '';
         }
 
-        const tagsToReplace = {
+        const charToReplace = {
             '&': '&',
             '<': '&lt;',
             '>': '&gt;',
+            '"': '&quot;',
         };
 
-        return title.replace(/[&<>]/g, function(tag) {
-            return tagsToReplace[tag] || tag;
+        return title.replace(/[&<>"]/g, function(tag) {
+            return charToReplace[tag] || tag;
         });
     }
+
+    /**
+     * @param {string} html
+     * @returns {string}
+     */
+    sanitize(html) {
+        return DOMPurify.sanitize(html);
+    }
 }

assets/js/widgets/KimaiCalendar.js

@@ -663,7 +663,7 @@ export default class KimaiCalendar {
             }
         }
 
-        return `
+        return escaper.sanitize(`
             <div class="calendar-entry">
                 <ul>
                     <li>` + this.options['translations']['customer'] + `: ` + escaper.escapeForHtml(eventObj.customer) + `</li>
@@ -672,7 +672,7 @@ export default class KimaiCalendar {
                 </ul>` +
                 (eventObj.description !== null || eventObj.tags.length > 0 ? '<hr>' : '') +
                 (eventObj.description ? '<div>' + escaper.escapeForHtml(eventObj.description) + '</div>' : '') + tags + `
-            </div>`;
+            </div>`);
     }
 
     /**

assets/sass/variables.scss

@@ -22,7 +22,7 @@
 .time-off { color: var(--kimai-time-off); }
 .other, .parental, .unpaid-vacation { color: var(--kimai-other); }
 
-.bg-public-holiday{ background-color: var(--kimai-public-holiday-bg); --tblr-table-bg: var(--kimai-public-holiday-bg); i.fas{ color: var(--kimai-public-holiday); } };
+.bg-public-holiday { background-color: var(--kimai-public-holiday-bg); --tblr-table-bg: var(--kimai-public-holiday-bg); i.fas{ color: var(--kimai-public-holiday); } };
 .bg-holiday { background-color: var(--kimai-holiday-bg); --tblr-table-bg: var(--kimai-holiday-bg); i.fas{ color: var(--kimai-holiday); } };
 .bg-sickness, .bg-sickness-child { background-color: var(--kimai-sickness-bg); --tblr-table-bg: var(--kimai-sickness-bg); i.fas{ color: var(--kimai-sickness); } };
 .bg-time-off { background-color: var(--kimai-time-off-bg); --tblr-table-bg: var(--kimai-time-off-bg); i.fas{ color: var(--kimai-time-off); } };