DRCIT/snipe-it
1
0
Fork 0
mirror of https://github.com/snipe/snipe-it.git synced 2025-01-12 14:27:33 -08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

Added allow list to modal view options

Browse source 
Signed-off-by: snipe <snipe@snipe.net>
This commit is contained in:
snipe 2021-12-30 18:16:49 -08:00
parent 950a23b0f4
commit c6ce928567
1 changed files with 36 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

44
app/Http/Controllers/ModalController.php
View file

@ -6,15 +6,43 @@ use App\Helpers\Helper;
class ModalController extends Controller
{
function show($type, $itemId = null) {
$view = view("modals.${type}");
if($type == "statuslabel") {
$view->with('statuslabel_types', Helper::statusTypeList());
/**
* Load the modal views after confirming they are in the allowed_types array.
* The allowed types away just prevents shithead skiddies from fuzzing the urls
* with automated scripts and junking up the logs. - snipe
*/
function show ($type, $itemId = null) {
$allowed_types = [
'category',
'kit-model',
'kit-license',
'kit-consumable',
'kit-accessory',
'location',
'manufacturer',
'model',
'statuslabel',
'supplier',
'upload-file',
'user',
];
if (in_array($type, $allowed_types)) {
$view = view("modals.${type}");
if ($type == "statuslabel") {
$view->with('statuslabel_types', Helper::statusTypeList());
}
if (in_array($type, ['kit-model', 'kit-license', 'kit-consumable', 'kit-accessory'])) {
$view->with('kitId', $itemId);
}
return $view;
}
if(in_array($type, ['kit-model', 'kit-license', 'kit-consumable', 'kit-accessory'])) {
$view->with('kitId', $itemId);
}
return $view;
abort(404,'Page not found');
}
}