pkp/pkp-lib#9421 replace v-html with v-strip-unsave-html

jardakotesovec · Feb 6, 2024 · c19cb87 · c19cb87
1 parent e113ddd
commit c19cb87
Show file tree

Hide file tree

Showing 6 changed files with 72 additions and 54 deletions.
diff --git a/.gitignore b/.gitignore
@@ -6,6 +6,7 @@ temp
 /plugins/paymethod/paypal/vendor/
 .project
 .project/
+.vscode
 .buildpath
 .settings/
 .htaccess

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -15,6 +15,7 @@
     "chart.js": "^2.9.4",
     "clone-deep": "^4.0.1",
     "debounce": "^1.2.0",
+    "dompurify": "^3.0.8",
     "element-resize-event": "^3.0.3",
     "moment": "^2.29.2",
     "tinymce": "^5.10.0",

diff --git a/plugins/importexport/native/templates/index.tpl b/plugins/importexport/native/templates/index.tpl
@@ -87,7 +87,7 @@
 								/>
 								<span
                                     class="listPanel__itemSubTitle"
-                                    v-html="localize(
+                                    v-strip-unsave-html="localize(
                                         item.publications.find(p => p.id == item.currentPublicationId).fullTitle,
                                         item.publications.find(p => p.id == item.currentPublicationId).locale
                                     )"

diff --git a/plugins/importexport/onix30/templates/index.tpl b/plugins/importexport/onix30/templates/index.tpl
@@ -59,7 +59,7 @@
 											/>
 											<span 
                                                 class="listPanel__itemSubTitle"
-                                                v-html="localize(
+                                                v-strip-unsave-html="localize(
                                                             item.publications.find(p => p.id == item.currentPublicationId).fullTitle,
                                                             item.publications.find(p => p.id == item.currentPublicationId).locale
                                                         )"

diff --git a/plugins/pubIds/urn/js/FieldTextUrn.js b/plugins/pubIds/urn/js/FieldTextUrn.js
@@ -10,76 +10,81 @@
  *
  * @brief A Vue.js component for URN text form field, that is used for custom suffixes, and that considers adding a check number.
  */
-var template = pkp.Vue.compile('<div class="pkpFormField pkpFormField--text pkpFormField--urn" :class="classes">' +
-'			<form-field-label' +
-'				:controlId="controlId"' +
-'				:label="label"' +
-'				:localeLabel="localeLabel"' +
-'				:isRequired="isRequired"' +
-'				:requiredLabel="__(\'common.required\')"' +
-'				:multilingualLabel="multilingualLabel"' +
-'			/>' +
-'			<div' +
-'				v-if="isPrimaryLocale && description"' +
-'				class="pkpFormField__description"' +
-'				v-html="description"' +
-'				:id="describedByDescriptionId"' +
-'			/>' +
-'			<div class="pkpFormField__control" :class="controlClasses">' +
-'				<input' +
-'					class="pkpFormField__input pkpFormField--text__input pkpFormField--urn__input"' +
-'					ref="input"' +
-'					v-model="currentValue"' +
-'					:type="inputType"' +
-'					:id="controlId"' +
-'					:name="localizedName"' +
-'					:aria-describedby="describedByIds"' +
-'					:aria-invalid="!!errors.length"' +
-'					:required="isRequired"' +
-'					:style="inputStyles"' +
-'				/>' +
-'				<button' +
-'					v-if="applyCheckNumber"' +
-'					class="pkpButton pkpFormField--urn__button"' +
-'					@click.prevent="addCheckNumber"' +
-'				>' +
-'					{{ addCheckNumberLabel }}' +
-'				</button>' +
-'				<field-error' +
-'					v-if="errors.length"' +
-'					:id="describedByErrorId"' +
-'					:messages="errors"' +
-'				/>' +
-'				</div>' +
-'			</div>' +
-'		</div>');
+var template = pkp.Vue.compile(
+	'<div class="pkpFormField pkpFormField--text pkpFormField--urn" :class="classes">' +
+		'			<form-field-label' +
+		'				:controlId="controlId"' +
+		'				:label="label"' +
+		'				:localeLabel="localeLabel"' +
+		'				:isRequired="isRequired"' +
+		'				:requiredLabel="__(\'common.required\')"' +
+		'				:multilingualLabel="multilingualLabel"' +
+		'			/>' +
+		'			<div' +
+		'				v-if="isPrimaryLocale && description"' +
+		'				class="pkpFormField__description"' +
+		'				v-strip-unsave-html="description"' +
+		'				:id="describedByDescriptionId"' +
+		'			/>' +
+		'			<div class="pkpFormField__control" :class="controlClasses">' +
+		'				<input' +
+		'					class="pkpFormField__input pkpFormField--text__input pkpFormField--urn__input"' +
+		'					ref="input"' +
+		'					v-model="currentValue"' +
+		'					:type="inputType"' +
+		'					:id="controlId"' +
+		'					:name="localizedName"' +
+		'					:aria-describedby="describedByIds"' +
+		'					:aria-invalid="!!errors.length"' +
+		'					:required="isRequired"' +
+		'					:style="inputStyles"' +
+		'				/>' +
+		'				<button' +
+		'					v-if="applyCheckNumber"' +
+		'					class="pkpButton pkpFormField--urn__button"' +
+		'					@click.prevent="addCheckNumber"' +
+		'				>' +
+		'					{{ addCheckNumberLabel }}' +
+		'				</button>' +
+		'				<field-error' +
+		'					v-if="errors.length"' +
+		'					:id="describedByErrorId"' +
+		'					:messages="errors"' +
+		'				/>' +
+		'				</div>' +
+		'			</div>' +
+		'		</div>'
+);
 
 pkp.Vue.component('field-text-urn', {
 	name: 'FieldTextUrn',
 	extends: pkp.Vue.component('field-text'),
 	props: {
 		addCheckNumberLabel: {
 			type: String,
-			required: true
+			required: true,
 		},
 		urnPrefix: {
 			type: String,
-			required: true
+			required: true,
 		},
 		applyCheckNumber: {
 			type: Boolean,
-			required: true
-		}
+			required: true,
+		},
 	},
 	methods: {
 		/**
 		 * Add a check number to the end of the URN
 		 */
 		addCheckNumber() {
-			this.currentValue += $.pkp.plugins.generic.urn.getCheckNumber(this.currentValue, this.urnPrefix);
-		}
+			this.currentValue += $.pkp.plugins.generic.urn.getCheckNumber(
+				this.currentValue,
+				this.urnPrefix
+			);
+		},
 	},
-	render: function(h) {
+	render: function (h) {
 		return template.render.call(this, h);
-	}
-});
+	},
+});