Commit d1bbc01c authored by Rene Saarsoo's avatar Rene Saarsoo
Browse files

Fix XSS vulnerability of error pages. 

Fixes: #376
parent 0b571ea9

template/app/controller/Classes.js

+1 −1
Original line number Diff line number Diff line
@@ -228,7 +228,7 @@ Ext.define('Docs.controller.Classes', { 
                failure: function(response, opts) {

                    this.cache[cls] = false;

                    this.getOverview().setLoading(false);

                    this.getController('Failure').show404("Class <b>"+cls+"</b> was not found.");

                    this.getController('Failure').show404("Class <b>"+Ext.String.htmlEncode(cls)+"</b> was not found.");

                },

                scope: this

            });

template/app/controller/Examples.js

+1 −1
Original line number Diff line number Diff line
@@ -90,7 +90,7 @@ Ext.define('Docs.controller.Examples', { 
    loadExample: function(url, noHistory) {

        var example = this.getExample(url);

        if (!example) {

            this.getController('Failure').show404("Example <b>"+url+"</b> was not found.");

            this.getController('Failure').show404("Example <b>"+Ext.String.htmlEncode(url)+"</b> was not found.");

            return;

        }

        this.getViewport().setPageTitle(example.text);

template/app/controller/Guides.js

+1 −1
Original line number Diff line number Diff line
@@ -119,7 +119,7 @@ Ext.define('Docs.controller.Guides', { 
                },

                failure: function(response, opts) {

                    this.cache[name] = false;

                    this.getController('Failure').show404("Guide <b>"+name+"</b> was not found.");

                    this.getController('Failure').show404("Guide <b>"+Ext.String.htmlEncode(name)+"</b> was not found.");

                },

                scope: this

            });

template/app/controller/Videos.js

+1 −1
Original line number Diff line number Diff line
@@ -59,7 +59,7 @@ Ext.define('Docs.controller.Videos', { 


        var video = this.getVideo(name);

        if (!video) {

            this.getController('Failure').show404("Video <b>"+name+"</b> was not found.");

            this.getController('Failure').show404("Video <b>"+Ext.String.htmlEncode(name)+"</b> was not found.");

            return;

        }

        this.getViewport().setPageTitle(video.title);