Merge branch 'release/1.10.28'

getgrav · Jan 24, 2022 · 3be295f · 3be295f
2 parents e46ca6f + 652b0c4
commit 3be295f
Show file tree

Hide file tree

Showing 6 changed files with 104,491 additions and 5,746 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,3 +1,10 @@
+# v1.10.28
+## 01/24/2022
+
+1. [](#bugfix)
+  * Clean file names before displaying errors/metadata modals
+  * Recompiled JS for production [#2225](https://github.com/getgrav/grav-plugin-admin/issues/2225)
+
 # v1.10.27
 ## 01/12/2022
 

diff --git a/blueprints.yaml b/blueprints.yaml
@@ -1,7 +1,7 @@
 name: Admin Panel
 slug: admin
 type: plugin
-version: 1.10.27
+version: 1.10.28
 description: Adds an advanced administration panel to manage your site
 icon: empire
 author:
@@ -15,7 +15,7 @@ docs: https://github.com/getgrav/grav-plugin-admin/blob/develop/README.md
 license: MIT
 
 dependencies:
-    - { name: grav, version: '>=1.7.27' }
+    - { name: grav, version: '>=1.7.28' }
     - { name: form, version: '>=5.1.0' }
     - { name: login, version: '>=3.6.2' }
     - { name: email, version: '>=3.1.0' }

diff --git a/themes/grav/app/forms/fields/files.js b/themes/grav/app/forms/fields/files.js
@@ -224,7 +224,7 @@ export default class FilesField {
             file,
             data: response,
             mode: 'removeFile',
-            msg: `<p>${translations.PLUGIN_ADMIN.FILE_ERROR_UPLOAD} <strong>${file.name}</strong></p>
+            msg: `<p>${translations.PLUGIN_ADMIN.FILE_ERROR_UPLOAD} <strong>{{fileName}}</strong></p>
             <pre>${response.message}</pre>`
         });
     }
@@ -240,7 +240,7 @@ export default class FilesField {
                 file,
                 data,
                 mode: 'removeFile',
-                msg: `<p>${translations.PLUGIN_ADMIN.FILE_ERROR_ADD} <strong>${file.name}</strong></p>
+                msg: `<p>${translations.PLUGIN_ADMIN.FILE_ERROR_ADD} <strong>{{fileName}}</strong></p>
                 <pre>${data.message}</pre>`
             });
         }
@@ -325,7 +325,9 @@ export default class FilesField {
         }
 
         let modal = $('[data-remodal-id="generic"]');
-        modal.find('.error-content').html(msg);
+        const cleanName = file.name.replace('<', '&lt;').replace('>', '&gt;');
+
+        modal.find('.error-content').html(msg.replace('{{fileName}}', cleanName));
         $.remodal.lookup[modal.data('remodal')].open();
     }
 }

diff --git a/themes/grav/app/pages/page/media.js b/themes/grav/app/pages/page/media.js
@@ -155,6 +155,7 @@ export default class PageMedia extends FilesField {
             const target = $(e.currentTarget);
             const file = target.parent('.dz-preview').find('.dz-filename');
             const filename = encodeURI(file.text());
+            const cleanName = file.text().replace('<', '&lt;').replace('>', '&gt;');
 
             let fileObj = this.dropzone.files.filter((file) => file.name === global.decodeURI(filename)).shift() || {};
 
@@ -163,22 +164,23 @@ export default class PageMedia extends FilesField {
             }
 
             if (Array.isArray(fileObj.extras.metadata) && !fileObj.extras.metadata.length) {
-                fileObj.extras.metadata = { '': `${global.decodeURI(filename)}.meta.yaml doesn't exist` };
+                fileObj.extras.metadata = { '': `${cleanName}.meta.yaml doesn't exist` };
             }
 
             fileObj = fileObj.extras;
 
             const modal_element = $('body').find('[data-remodal-id="metadata"]');
             const modal = $.remodal.lookup[modal_element.data('remodal')];
 
-            modal_element.find('h1 strong').html(filename);
+            modal_element.find('h1 strong').html(cleanName);
             if (fileObj.url) {
                 modal_element.find('.meta-preview').html(`<img src="${fileObj.url}" />`);
             }
 
             const container = modal_element.find('.meta-content').html('<ul />').find('ul');
             Object.keys(fileObj.metadata).forEach((meta) => {
-                container.append(`<li><strong>${meta ? meta + ':' : ''}</strong> ${fileObj.metadata[meta]}</li>`);
+                const cleanMeta = fileObj.metadata[meta].replace('<', '&lt;').replace('>', '&gt;');
+                container.append(`<li><strong>${meta ? meta + ':' : ''}</strong> ${cleanMeta}</li>`);
             });
 
             modal.open();