Update

- Fixed : striping tags that are inputed by the end user.
Blair2004 · Mar 17, 2021 · 80f1387 · 80f1387
1 parent a7dbdd7
commit 80f1387
Show file tree

Hide file tree

Showing 4 changed files with 5 additions and 5 deletions.
diff --git a/app/Forms/UserProfileForm.php b/app/Forms/UserProfileForm.php
@@ -59,7 +59,7 @@ public function processAttribute( $request )
 
             foreach( $request->input( 'attribute' ) as $key => $value ) {
                 if ( in_array( $key, $allowedInputs ) ) {
-                    $user->$key     =   preg_replace( '#<script(.*?)>(.*?)</script>#is', '', $value );
+                    $user->$key     =   strip_tags( $value );
                 }
             }
 

diff --git a/app/Http/Controllers/Dashboard/CrudController.php b/app/Http/Controllers/Dashboard/CrudController.php
@@ -120,7 +120,7 @@ public function crudPost( String $namespace, CrudPostRequest $request )
              * all script tags
              */
             if ( ! empty( $entry->$name ) ) {
-                $entry->$name       =   preg_replace( '#<script(.*?)>(.*?)</script>#is', null, $entry->$name );
+                $entry->$name       =   strip_tags( $entry->$name );
             }
         }
 
@@ -243,7 +243,7 @@ public function crudPut( String $namespace, $id, CrudPutRequest $request  )
              * all script tags
              */
             if ( ! empty( $entry->$name ) ) {
-                $entry->$name       =   preg_replace( '#<script(.*?)>(.*?)</script>#is', null, $entry->$name );
+                $entry->$name       =   strip_tags( $entry->$name );
             }
         }
 

diff --git a/app/Services/Options.php b/app/Services/Options.php
@@ -154,7 +154,7 @@ public function beforeSave( $option )
         * sanitizing input to remove
         * all script tags
         */
-        $option->value      =   preg_replace( '#<script(.*?)>(.*?)</script>#is', '', $option->value );
+        $option->value      =   strip_tags( $option->value );
 
         return $option;
     }

diff --git a/app/Services/UserOptions.php b/app/Services/UserOptions.php
@@ -27,7 +27,7 @@ public function beforeSave( $option )
         * sanitizing input to remove
         * all script tags
         */
-        $option->value      =   preg_replace( '#<script(.*?)>(.*?)</script>#is', '', $option->value );   
+        $option->value      =   strip_tags( $option->value );   
 
         return $option;
     }