From 078d12bc0e26065d955f9297bf7f9031cd5104b3 Mon Sep 17 00:00:00 2001 From: Eldad Fux Date: Tue, 23 Feb 2021 18:17:45 +0200 Subject: [PATCH 1/2] Fixed XSS issue --- app/tasks/doctor.php | 1 - app/views/console/database/search/files.phtml | 1 + app/views/console/functions/function.phtml | 2 +- app/views/console/home/index.phtml | 10 +++++-- app/views/console/storage/index.phtml | 1 + public/dist/scripts/app-all.js | 9 +++--- public/dist/scripts/app.js | 9 +++--- public/scripts/dependencies/litespeed.js | 2 +- public/scripts/filters.js | 30 ++++++++++++++----- 9 files changed, 45 insertions(+), 20 deletions(-) diff --git a/app/tasks/doctor.php b/app/tasks/doctor.php index 2918d4f1e4..0f601bb5b5 100644 --- a/app/tasks/doctor.php +++ b/app/tasks/doctor.php @@ -139,7 +139,6 @@ $cli Console::success('SMTP................connected 👍'); } catch (\Throwable $th) { Console::error('SMTP.............disconnected 👎'); - var_dump($th); } $host = App::getEnv('_APP_STATSD_HOST', 'telegraf'); diff --git a/app/views/console/database/search/files.phtml b/app/views/console/database/search/files.phtml index ac9f76e0ea..0a1b4d739c 100644 --- a/app/views/console/database/search/files.phtml +++ b/app/views/console/database/search/files.phtml @@ -64,6 +64,7 @@ + diff --git a/app/views/console/functions/function.phtml b/app/views/console/functions/function.phtml index 74960eba48..4ae65f491e 100644 --- a/app/views/console/functions/function.phtml +++ b/app/views/console/functions/function.phtml @@ -117,7 +117,7 @@ $usageStatsEnabled = $this->getParam('usageStatsEnabled',true);  
- +
getParam('usageStatsEnabled',true);
-
0
+
+ 0 + +
Bandwidth
@@ -117,7 +120,10 @@ $usageStatsEnabled = $this->getParam('usageStatsEnabled',true);
Documents
-
0
+
+ 0 + +
Storage
diff --git a/app/views/console/storage/index.phtml b/app/views/console/storage/index.phtml index bd39699592..6b03814ae2 100644 --- a/app/views/console/storage/index.phtml +++ b/app/views/console/storage/index.phtml @@ -204,6 +204,7 @@ $fileLimitHuman = $this->getParam('fileLimitHuman', 0); + diff --git a/public/dist/scripts/app-all.js b/public/dist/scripts/app-all.js index 6e2367f10a..e53871531e 100644 --- a/public/dist/scripts/app-all.js +++ b/public/dist/scripts/app-all.js @@ -2071,7 +2071,7 @@ container.path(paths[i],value);}});} return;} if(element.value!==value){element.value=value;element.dispatchEvent(new Event('change'));} if(bind){element.addEventListener('input',sync);element.addEventListener('change',sync);}} -else{if(element.innerHTML!=value){element.innerHTML=value;}}};let sync=(()=>{return()=>{if(debug){console.info('debug-ls-bind','sync-path',paths);console.info('debug-ls-bind','sync-syntax',syntax);console.info('debug-ls-bind','sync-syntax-parsed',parsedSyntax);console.info('debug-ls-bind','sync-value',element.value);} +else{if(element.textContent!=value){element.textContent=value;}}};let sync=(()=>{return()=>{if(debug){console.info('debug-ls-bind','sync-path',paths);console.info('debug-ls-bind','sync-syntax',syntax);console.info('debug-ls-bind','sync-syntax-parsed',parsedSyntax);console.info('debug-ls-bind','sync-value',element.value);} for(let i=0;i=thresh&&u'+ -units[u]+"");}).add("statsTotal",function($value){if(!$value){return 0;} +let thresh=1000;if(Math.abs($value)=thresh&&u=thresh&&u{return()=>{if(debug){console.info('debug-ls-bind','sync-path',paths);console.info('debug-ls-bind','sync-syntax',syntax);console.info('debug-ls-bind','sync-syntax-parsed',parsedSyntax);console.info('debug-ls-bind','sync-value',element.value);} +else{if(element.textContent!=value){element.textContent=value;}}};let sync=(()=>{return()=>{if(debug){console.info('debug-ls-bind','sync-path',paths);console.info('debug-ls-bind','sync-syntax',syntax);console.info('debug-ls-bind','sync-syntax-parsed',parsedSyntax);console.info('debug-ls-bind','sync-value',element.value);} for(let i=0;i=thresh&&u'+ -units[u]+"");}).add("statsTotal",function($value){if(!$value){return 0;} +let thresh=1000;if(Math.abs($value)=thresh&&u=thresh&&u{return()=>{if(debug){console.info('debug-ls-bind','sync-path',paths);console.info('debug-ls-bind','sync-syntax',syntax);console.info('debug-ls-bind','sync-syntax-parsed',parsedSyntax);console.info('debug-ls-bind','sync-value',element.value);} +else{if(element.textContent!=value){element.textContent=value;}}};let sync=(()=>{return()=>{if(debug){console.info('debug-ls-bind','sync-path',paths);console.info('debug-ls-bind','sync-syntax',syntax);console.info('debug-ls-bind','sync-syntax-parsed',parsedSyntax);console.info('debug-ls-bind','sync-value',element.value);} for(let i=0;i= thresh && u < units.length - 1); - return ( - $value.toFixed(1) + - '' + - units[u] + - "" - ); + return $value.toFixed(1); + }) + .add("humanFileUnit", function($value) { + if (!$value) { + return ''; + } + + let thresh = 1000; + + if (Math.abs($value) < thresh) { + return 'B'; + } + + let units = ["kB", "MB", "GB", "TB", "PB", "EB", "ZB", "YB"]; + let u = -1; + + do { + $value /= thresh; + ++u; + } while (Math.abs($value) >= thresh && u < units.length - 1); + + return units[u]; }) .add("statsTotal", function($value) { if (!$value) { From 557144b0971ab3c0778e61c39a93d04db76c2ee3 Mon Sep 17 00:00:00 2001 From: Eldad Fux Date: Tue, 23 Feb 2021 18:20:02 +0200 Subject: [PATCH 2/2] Updated changelog --- CHANGES.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/CHANGES.md b/CHANGES.md index 31da3f55fe..63e9f6cdef 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -26,6 +26,10 @@ - Updated missing storage env vars +## Security + +- Fixed an XSS vulnerability in the Appwrite console + # Version 0.7.0 ## Features