Sākums Izpētīt Palīdzība
Pierakstīties
mirrors
/
mailcow-dockerized
spogulis no https://github.com/mailcow/mailcow-dockerized
2
0
Atdalīts 0
Faili Problēmas 0 Vikivietne
Pārlūkot izejas kodu

[Web] Even more fixes for #1017

André Peters 7 gadi atpakaļ
vecāks
8e1ac0bfbb
revīzija
618be3bf14
8 mainītis faili ar 42 papildinājumiem un 42 dzēšanām
Apvienotais skats Rādīt salīdzināšanas statistiku
  1. 2 2
      data/web/inc/footer.inc.php
  2. 6 10
      data/web/inc/functions.inc.php
  3. 1 1
      data/web/inc/functions.policy.inc.php
  4. 3 3
      data/web/inc/header.inc.php
  5. 4 3
      data/web/inc/triggers.inc.php
  6. 6 5
      data/web/js/mailbox.js
  7. 10 8
      data/web/js/user.js
  8. 10 10
      data/web/user.php

+ 2 - 2
data/web/inc/footer.inc.php
Parādīt failu 

@@ -61,7 +61,7 @@ $(document).ready(function() {
 
           type: "GET",
 
           type: "GET",
 
           cache: false,
 
           cache: false,
 
           dataType: 'script',
 
           dataType: 'script',
 
-          url: "/api/v1/get/u2f-authentication/<?= (isset($_SESSION['pending_mailcow_cc_username'])) ? $_SESSION['pending_mailcow_cc_username'] : null; ?>",
 
+          url: "/api/v1/get/u2f-authentication/<?= (isset($_SESSION['pending_mailcow_cc_username'])) ? rawurlencode($_SESSION['pending_mailcow_cc_username']) : null; ?>",
 
           complete: function(data){
 
           complete: function(data){
 
             $('#u2f_status_auth').html('<?=$lang['tfa']['waiting_usb_auth'];?>');
 
             $('#u2f_status_auth').html('<?=$lang['tfa']['waiting_usb_auth'];?>');
 
             data;
 
             data;
 
@@ -100,7 +100,7 @@ $(document).ready(function() {
 
         type: "GET",
 
         type: "GET",
 
         cache: false,
 
         cache: false,
 
         dataType: 'script',
 
         dataType: 'script',
 
-        url: "/api/v1/get/u2f-registration/<?= (isset($_SESSION['mailcow_cc_username'])) ? $_SESSION['mailcow_cc_username'] : null; ?>",
 
+        url: "/api/v1/get/u2f-registration/<?= (isset($_SESSION['mailcow_cc_username'])) ? rawurlencode($_SESSION['mailcow_cc_username']) : null; ?>",
 
         complete: function(data){
 
         complete: function(data){
 
           data;
 
           data;
 
           setTimeout(function() {
 
           setTimeout(function() {

+ 6 - 10
data/web/inc/functions.inc.php
Parādīt failu 

@@ -39,7 +39,7 @@ function hasDomainAccess($username, $role, $domain) {
 
 }

 }

 function hasMailboxObjectAccess($username, $role, $object) {

 function hasMailboxObjectAccess($username, $role, $object) {

 	global $pdo;

 	global $pdo;

-	if (!filter_var($username, FILTER_VALIDATE_EMAIL) && !ctype_alnum(str_replace(array('_', '.', '-'), '', $username))) {

+	if (!filter_var(html_entity_decode(rawurldecode($username)), FILTER_VALIDATE_EMAIL) && !ctype_alnum(str_replace(array('_', '.', '-'), '', $username))) {

 		return false;

 		return false;

 	}

 	}

 	if ($role != 'admin' && $role != 'domainadmin' && $role != 'user') {

 	if ($role != 'admin' && $role != 'domainadmin' && $role != 'user') {

@@ -471,22 +471,18 @@ function user_get_alias_details($username) {
 
       ));

       ));

     $run = $stmt->fetchAll(PDO::FETCH_ASSOC);

     $run = $stmt->fetchAll(PDO::FETCH_ASSOC);

     while ($row = array_shift($run)) {

     while ($row = array_shift($run)) {

-      $data['direct_aliases'] = $row['direct_aliases'];

+      $data['direct_aliases'][] = $row['direct_aliases'];

     }

     }

-    $stmt = $pdo->prepare("SELECT IFNULL(GROUP_CONCAT(local_part, '@', alias_domain SEPARATOR ', '), '&#10008;') AS `ad_alias` FROM `mailbox`

+    $stmt = $pdo->prepare("SELECT GROUP_CONCAT(local_part, '@', alias_domain SEPARATOR ', ') AS `ad_alias` FROM `mailbox`

       LEFT OUTER JOIN `alias_domain` on `target_domain` = `domain`

       LEFT OUTER JOIN `alias_domain` on `target_domain` = `domain`

         WHERE `username` = :username ;");

         WHERE `username` = :username ;");

     $stmt->execute(array(':username' => $username));

     $stmt->execute(array(':username' => $username));

     $run = $stmt->fetchAll(PDO::FETCH_ASSOC);

     $run = $stmt->fetchAll(PDO::FETCH_ASSOC);

     while ($row = array_shift($run)) {

     while ($row = array_shift($run)) {

-      if (empty($data['direct_aliases'])) {

-        $data['direct_aliases'] = $row['ad_alias'];

-      }

-      else {

-        // Probably faster than imploding

-        $data['direct_aliases'] .= ', ' . $row['ad_alias'];

-      }

+      $data['direct_aliases'][] = $row['ad_alias'];

     }

     }

+    $data['direct_aliases'] = implode(', ', array_filter($data['direct_aliases']));

+    $data['direct_aliases'] = empty($data['direct_aliases']) ? '&#10008;' : $data['direct_aliases'];

     $stmt = $pdo->prepare("SELECT IFNULL(GROUP_CONCAT(`send_as` SEPARATOR ', '), '&#10008;') AS `send_as` FROM `sender_acl` WHERE `logged_in_as` = :username AND `send_as` NOT LIKE '@%';");

     $stmt = $pdo->prepare("SELECT IFNULL(GROUP_CONCAT(`send_as` SEPARATOR ', '), '&#10008;') AS `send_as` FROM `sender_acl` WHERE `logged_in_as` = :username AND `send_as` NOT LIKE '@%';");

     $stmt->execute(array(':username' => $username));

     $stmt->execute(array(':username' => $username));

     $run = $stmt->fetchAll(PDO::FETCH_ASSOC);

     $run = $stmt->fetchAll(PDO::FETCH_ASSOC);

+ 1 - 1
data/web/inc/functions.policy.inc.php
Parādīt failu 

@@ -94,7 +94,7 @@ function policy($_action, $_scope, $_data = null) {
 
           if (!hasMailboxObjectAccess($_SESSION['mailcow_cc_username'], $_SESSION['mailcow_cc_role'], $object)) {

           if (!hasMailboxObjectAccess($_SESSION['mailcow_cc_username'], $_SESSION['mailcow_cc_role'], $object)) {

             $_SESSION['return'] = array(

             $_SESSION['return'] = array(

               'type' => 'danger',

               'type' => 'danger',

-              'msg' => sprintf($lang['danger']['access_denied'])

+              'msg' => $object

             );

             );

             return false;

             return false;

           }

           }

+ 3 - 3
data/web/inc/header.inc.php
Parādīt failu 

@@ -1,4 +1,4 @@
 
-<!DOCTYPE html>
 
+  <!DOCTYPE html>
 
 <html lang="<?= $_SESSION['mailcow_locale'] ?>">
 
 <html lang="<?= $_SESSION['mailcow_locale'] ?>">
 
 <head>
 
 <head>
 
 <meta charset="utf-8">
 
 <meta charset="utf-8">
 
@@ -129,11 +129,11 @@
 
         }
 
         }
 
         if (!isset($_SESSION['dual-login']) && isset($_SESSION['mailcow_cc_username'])):
 
         if (!isset($_SESSION['dual-login']) && isset($_SESSION['mailcow_cc_username'])):
 
         ?>
 
         ?>
 
-          <li class="logged-in-as"><a href="#" onclick="logout.submit()"><b><?= $_SESSION['mailcow_cc_username']; ?></b> <span class="glyphicon glyphicon-log-out"></span></a></li>
 
+          <li class="logged-in-as"><a href="#" onclick="logout.submit()"><b><?= htmlspecialchars($_SESSION['mailcow_cc_username']); ?></b> <span class="glyphicon glyphicon-log-out"></span></a></li>
 
         <?php
 
         <?php
 
         elseif (isset($_SESSION['dual-login'])):
 
         elseif (isset($_SESSION['dual-login'])):
 
         ?>
 
         ?>
 
-          <li class="logged-in-as"><a href="#" onclick="logout.submit()"><b><?= $_SESSION['mailcow_cc_username']; ?> <span class="text-info">(<?= $_SESSION['dual-login']['username']; ?>)</span> </b><span class="glyphicon glyphicon-log-out"></span></a></li>
 
+          <li class="logged-in-as"><a href="#" onclick="logout.submit()"><b><?= htmlspecialchars($_SESSION['mailcow_cc_username']); ?> <span class="text-info">(<?= htmlspecialchars($_SESSION['dual-login']['username']); ?>)</span> </b><span class="glyphicon glyphicon-log-out"></span></a></li>
 
         <?php
 
         <?php
 
         endif;
 
         endif;
 
         ?>
 
         ?>

+ 4 - 3
data/web/inc/triggers.inc.php
Parādīt failu 

@@ -43,11 +43,12 @@ if (isset($_POST["login_user"]) && isset($_POST["pass_user"])) {
 
 
 
 if (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == "admin") {
 
 if (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == "admin") {
 
 	if (isset($_GET["duallogin"])) {
 
 	if (isset($_GET["duallogin"])) {
 
-    if (filter_var($_GET["duallogin"], FILTER_VALIDATE_EMAIL)) {
 
-      if (!empty(mailbox('get', 'mailbox_details', $_GET["duallogin"]))) {
 
+    $duallogin = html_entity_decode(rawurldecode($_GET["duallogin"]));
 
+    if (filter_var($duallogin, FILTER_VALIDATE_EMAIL)) {
 
+      if (!empty(mailbox('get', 'mailbox_details', $duallogin))) {
 
         $_SESSION["dual-login"]["username"] = $_SESSION['mailcow_cc_username'];
 
         $_SESSION["dual-login"]["username"] = $_SESSION['mailcow_cc_username'];
 
         $_SESSION["dual-login"]["role"]     = $_SESSION['mailcow_cc_role'];
 
         $_SESSION["dual-login"]["role"]     = $_SESSION['mailcow_cc_role'];
 
-        $_SESSION['mailcow_cc_username']    = $_GET["duallogin"];
 
+        $_SESSION['mailcow_cc_username']    = $duallogin;
 
         $_SESSION['mailcow_cc_role']        = "user";
 
         $_SESSION['mailcow_cc_role']        = "user";
 
         header("Location: /user.php");
 
         header("Location: /user.php");
 
       }
 
       }

+ 6 - 5
data/web/js/mailbox.js
Parādīt failu 

@@ -250,7 +250,6 @@ jQuery(function($){
 
           $.each(data, function (i, item) {

           $.each(data, function (i, item) {

             item.quota = item.quota_used + "/" + item.quota;

             item.quota = item.quota_used + "/" + item.quota;

             item.max_quota_for_mbox = humanFileSize(item.max_quota_for_mbox);

             item.max_quota_for_mbox = humanFileSize(item.max_quota_for_mbox);

-            item.username = escapeHtml(item.username);

             item.chkbox = '<input type="checkbox" data-id="mailbox" name="multi_select" value="' + encodeURIComponent(item.username) + '" />';

             item.chkbox = '<input type="checkbox" data-id="mailbox" name="multi_select" value="' + encodeURIComponent(item.username) + '" />';

             if (role == "admin") {

             if (role == "admin") {

             item.action = '<div class="btn-group">' +

             item.action = '<div class="btn-group">' +

@@ -268,7 +267,7 @@ jQuery(function($){
 
             item.in_use = '<div class="progress">' +

             item.in_use = '<div class="progress">' +

               '<div class="progress-bar progress-bar-' + item.percent_class + ' role="progressbar" aria-valuenow="' + item.percent_in_use + '" aria-valuemin="0" aria-valuemax="100" ' +

               '<div class="progress-bar progress-bar-' + item.percent_class + ' role="progressbar" aria-valuenow="' + item.percent_in_use + '" aria-valuemin="0" aria-valuemax="100" ' +

               'style="min-width:2em;width:' + item.percent_in_use + '%">' + item.percent_in_use + '%' + '</div></div>';

               'style="min-width:2em;width:' + item.percent_in_use + '%">' + item.percent_in_use + '%' + '</div></div>';

-

+            item.username = escapeHtml(item.username);

           });

           });

         }

         }

       }),

       }),

@@ -309,12 +308,12 @@ jQuery(function($){
 
         },

         },

         success: function (data) {

         success: function (data) {

           $.each(data, function (i, item) {

           $.each(data, function (i, item) {

-            item.name = escapeHtml(item.name);

             item.action = '<div class="btn-group">' +

             item.action = '<div class="btn-group">' +

               '<a href="/edit.php?resource=' + encodeURIComponent(item.name) + '" class="btn btn-xs btn-default"><span class="glyphicon glyphicon-pencil"></span> ' + lang.edit + '</a>' +

               '<a href="/edit.php?resource=' + encodeURIComponent(item.name) + '" class="btn btn-xs btn-default"><span class="glyphicon glyphicon-pencil"></span> ' + lang.edit + '</a>' +

               '<a href="#" id="delete_selected" data-id="single-resource" data-api-url="delete/resource" data-item="' + encodeURIComponent(item.name) + '" class="btn btn-xs btn-danger"><span class="glyphicon glyphicon-trash"></span> ' + lang.remove + '</a>' +

               '<a href="#" id="delete_selected" data-id="single-resource" data-api-url="delete/resource" data-item="' + encodeURIComponent(item.name) + '" class="btn btn-xs btn-danger"><span class="glyphicon glyphicon-trash"></span> ' + lang.remove + '</a>' +

               '</div>';

               '</div>';

             item.chkbox = '<input type="checkbox" data-id="resource" name="multi_select" value="' + encodeURIComponent(item.name) + '" />';

             item.chkbox = '<input type="checkbox" data-id="resource" name="multi_select" value="' + encodeURIComponent(item.name) + '" />';

+            item.name = escapeHtml(item.name);

           });

           });

         }

         }

       }),

       }),

@@ -461,10 +460,12 @@ jQuery(function($){
 
               '</div>';

               '</div>';

             item.chkbox = '<input type="checkbox" data-id="alias" name="multi_select" value="' + encodeURIComponent(item.address) + '" />';

             item.chkbox = '<input type="checkbox" data-id="alias" name="multi_select" value="' + encodeURIComponent(item.address) + '" />';

             item.goto = escapeHtml(item.goto);

             item.goto = escapeHtml(item.goto);

-            item.address = escapeHtml(item.address);

             if (item.is_catch_all == 1) {

             if (item.is_catch_all == 1) {

               item.address = '<div class="label label-default">Catch-All</div> ' + escapeHtml(item.address);

               item.address = '<div class="label label-default">Catch-All</div> ' + escapeHtml(item.address);

             }

             }

+            else {

+              item.address = escapeHtml(item.address);

+            }

             if (item.goto == "null@localhost") {

             if (item.goto == "null@localhost") {

               item.goto = '⤷ <span style="font-size:12px" class="glyphicon glyphicon-trash" aria-hidden="true"></span>';

               item.goto = '⤷ <span style="font-size:12px" class="glyphicon glyphicon-trash" aria-hidden="true"></span>';

             }

             }

@@ -568,7 +569,7 @@ jQuery(function($){
 
             } else {

             } else {

               item.exclude  = '<code>' + item.exclude + '</code>';

               item.exclude  = '<code>' + item.exclude + '</code>';

             }

             }

-            item.server_w_port = item.user1 + '@' + item.host1 + ':' + item.port1;

+            item.server_w_port = escapeHtml(item.user1) + '@' + item.host1 + ':' + item.port1;

             item.action = '<div class="btn-group">' +

             item.action = '<div class="btn-group">' +

               '<a href="/edit.php?syncjob=' + item.id + '" class="btn btn-xs btn-default"><span class="glyphicon glyphicon-pencil"></span> ' + lang.edit + '</a>' +

               '<a href="/edit.php?syncjob=' + item.id + '" class="btn btn-xs btn-default"><span class="glyphicon glyphicon-pencil"></span> ' + lang.edit + '</a>' +

               '<a href="#" id="delete_selected" data-id="single-syncjob" data-api-url="delete/syncjob" data-item="' + item.id + '" class="btn btn-xs btn-danger"><span class="glyphicon glyphicon-trash"></span> ' + lang.remove + '</a>' +

               '<a href="#" id="delete_selected" data-id="single-syncjob" data-api-url="delete/syncjob" data-item="' + item.id + '" class="btn btn-xs btn-danger"><span class="glyphicon glyphicon-trash"></span> ' + lang.remove + '</a>' +

+ 10 - 8
data/web/js/user.js
Parādīt failu 

@@ -62,9 +62,10 @@ jQuery(function($){
 
           $.each(data, function (i, item) {

           $.each(data, function (i, item) {

             if (acl_data.spam_alias === 1) {

             if (acl_data.spam_alias === 1) {

               item.action = '<div class="btn-group">' +

               item.action = '<div class="btn-group">' +

-                '<a href="#" id="delete_selected" data-id="single-tla" data-api-url="delete/time_limited_alias" data-item="' + encodeURI(item.address) + '" class="btn btn-xs btn-danger"><span class="glyphicon glyphicon-trash"></span> ' + lang.remove + '</a>' +

+                '<a href="#" id="delete_selected" data-id="single-tla" data-api-url="delete/time_limited_alias" data-item="' + encodeURIComponent(item.address) + '" class="btn btn-xs btn-danger"><span class="glyphicon glyphicon-trash"></span> ' + lang.remove + '</a>' +

                 '</div>';

                 '</div>';

-              item.chkbox = '<input type="checkbox" data-id="tla" name="multi_select" value="' + item.address + '" />';

+              item.chkbox = '<input type="checkbox" data-id="tla" name="multi_select" value="' + encodeURIComponent(item.address) + '" />';

+              item.address = escapeHtml(item.address);

             }

             }

             else {

             else {

               item.chkbox = '<input type="checkbox" disabled />';

               item.chkbox = '<input type="checkbox" disabled />';

@@ -102,24 +103,25 @@ jQuery(function($){
 
       "empty": lang.empty,

       "empty": lang.empty,

       "rows": $.ajax({

       "rows": $.ajax({

         dataType: 'json',

         dataType: 'json',

-        url: '/api/v1/get/syncjobs/' + mailcow_cc_username + '/no_log',

+        url: '/api/v1/get/syncjobs/' + encodeURIComponent(mailcow_cc_username) + '/no_log',

         jsonp: false,

         jsonp: false,

         error: function () {

         error: function () {

           console.log('Cannot draw sync job table');

           console.log('Cannot draw sync job table');

         },

         },

         success: function (data) {

         success: function (data) {

           $.each(data, function (i, item) {

           $.each(data, function (i, item) {

-            item.log = '<a href="#syncjobLogModal" data-toggle="modal" data-syncjob-id="' + encodeURI(item.id) + '">Open logs</a>'

+            item.user1 = escapeHtml(item.user1);

+            item.log = '<a href="#syncjobLogModal" data-toggle="modal" data-syncjob-id="' + item.id + '">Open logs</a>'

             if (!item.exclude > 0) {

             if (!item.exclude > 0) {

               item.exclude = '-';

               item.exclude = '-';

             } else {

             } else {

-              item.exclude  = '<code>' + item.exclude + '</code>';

+              item.exclude  = '<code>' + escapeHtml(item.exclude) + '</code>';

             }

             }

-            item.server_w_port = item.user1 + '@' + item.host1 + ':' + item.port1;

+            item.server_w_port = escapeHtml(item.user1 + '@' + item.host1 + ':' + item.port1);

             if (acl_data.syncjobs === 1) {

             if (acl_data.syncjobs === 1) {

               item.action = '<div class="btn-group">' +

               item.action = '<div class="btn-group">' +

                 '<a href="/edit.php?syncjob=' + item.id + '" class="btn btn-xs btn-default"><span class="glyphicon glyphicon-pencil"></span> ' + lang.edit + '</a>' +

                 '<a href="/edit.php?syncjob=' + item.id + '" class="btn btn-xs btn-default"><span class="glyphicon glyphicon-pencil"></span> ' + lang.edit + '</a>' +

-                '<a href="#" id="delete_selected" data-id="single-syncjob" data-api-url="delete/syncjob" data-item="' + encodeURI(item.id) + '" class="btn btn-xs btn-danger"><span class="glyphicon glyphicon-trash"></span> ' + lang.remove + '</a>' +

+                '<a href="#" id="delete_selected" data-id="single-syncjob" data-api-url="delete/syncjob" data-item="' + item.id + '" class="btn btn-xs btn-danger"><span class="glyphicon glyphicon-trash"></span> ' + lang.remove + '</a>' +

                 '</div>';

                 '</div>';

               item.chkbox = '<input type="checkbox" data-id="syncjob" name="multi_select" value="' + item.id + '" />';

               item.chkbox = '<input type="checkbox" data-id="syncjob" name="multi_select" value="' + item.id + '" />';

             }

             }

@@ -238,7 +240,7 @@ jQuery(function($){
 
     $('#user_sieve_filter').text(lang.loading);

     $('#user_sieve_filter').text(lang.loading);

     $.ajax({

     $.ajax({

       dataType: 'json',

       dataType: 'json',

-      url: '/api/v1/get/active-user-sieve/' + mailcow_cc_username,

+      url: '/api/v1/get/active-user-sieve/' + encodeURIComponent(mailcow_cc_username),

       jsonp: false,

       jsonp: false,

       error: function () {

       error: function () {

         console.log('Cannot get active sieve script');

         console.log('Cannot get active sieve script');

+ 10 - 10
data/web/user.php
Parādīt failu 

@@ -164,21 +164,21 @@ elseif (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == '
 
 

 

       <button type="button" class="btn btn-sm btn-default <?=($get_tagging_options == "subfolder") ? 'active' : null; ?>"

       <button type="button" class="btn btn-sm btn-default <?=($get_tagging_options == "subfolder") ? 'active' : null; ?>"

         id="edit_selected"

         id="edit_selected"

-        data-item="<?= $username; ?>"

+        data-item="<?= htmlentities($username); ?>"

         data-id="delimiter_action"

         data-id="delimiter_action"

         data-api-url='edit/delimiter_action'

         data-api-url='edit/delimiter_action'

         data-api-attr='{"tagged_mail_handler":"subfolder"}'><?=$lang['user']['tag_in_subfolder'];?></button>

         data-api-attr='{"tagged_mail_handler":"subfolder"}'><?=$lang['user']['tag_in_subfolder'];?></button>

 

 

       <button type="button" class="btn btn-sm btn-default <?=($get_tagging_options == "subject") ? 'active' : null; ?>"

       <button type="button" class="btn btn-sm btn-default <?=($get_tagging_options == "subject") ? 'active' : null; ?>"

         id="edit_selected"

         id="edit_selected"

-        data-item="<?= $username; ?>"

+        data-item="<?= htmlentities($username); ?>"

         data-id="delimiter_action"

         data-id="delimiter_action"

         data-api-url='edit/delimiter_action'

         data-api-url='edit/delimiter_action'

         data-api-attr='{"tagged_mail_handler":"subject"}'><?=$lang['user']['tag_in_subject'];?></button>

         data-api-attr='{"tagged_mail_handler":"subject"}'><?=$lang['user']['tag_in_subject'];?></button>

 

 

       <button type="button" class="btn btn-sm btn-default <?=($get_tagging_options == "none") ? 'active' : null; ?>"

       <button type="button" class="btn btn-sm btn-default <?=($get_tagging_options == "none") ? 'active' : null; ?>"

         id="edit_selected"

         id="edit_selected"

-        data-item="<?= $username; ?>"

+        data-item="<?= htmlentities($username); ?>"

         data-id="delimiter_action"

         data-id="delimiter_action"

         data-api-url='edit/delimiter_action'

         data-api-url='edit/delimiter_action'

         data-api-attr='{"tagged_mail_handler":"none"}'><?=$lang['user']['tag_in_none'];?></button>

         data-api-attr='{"tagged_mail_handler":"none"}'><?=$lang['user']['tag_in_none'];?></button>

@@ -201,14 +201,14 @@ elseif (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == '
 
 

 

       <button type="button" class="btn btn-sm btn-default <?=($get_tls_policy['tls_enforce_in'] == "1") ? "active" : null;?>"

       <button type="button" class="btn btn-sm btn-default <?=($get_tls_policy['tls_enforce_in'] == "1") ? "active" : null;?>"

         id="edit_selected"

         id="edit_selected"

-        data-item="<?= $username; ?>"

+        data-item="<?= htmlentities($username); ?>"

         data-id="tls_policy"

         data-id="tls_policy"

         data-api-url='edit/tls_policy'

         data-api-url='edit/tls_policy'

         data-api-attr='{"tls_enforce_in":<?=($get_tls_policy['tls_enforce_in'] == "1") ? "0" : "1";?>}'><?=$lang['user']['tls_enforce_in'];?></button>

         data-api-attr='{"tls_enforce_in":<?=($get_tls_policy['tls_enforce_in'] == "1") ? "0" : "1";?>}'><?=$lang['user']['tls_enforce_in'];?></button>

 

 

       <button type="button" class="btn btn-sm btn-default <?=($get_tls_policy['tls_enforce_out'] == "1") ? "active" : null;?>"

       <button type="button" class="btn btn-sm btn-default <?=($get_tls_policy['tls_enforce_out'] == "1") ? "active" : null;?>"

         id="edit_selected"

         id="edit_selected"

-        data-item="<?= $username; ?>"

+        data-item="<?= htmlentities($username); ?>"

         data-id="tls_policy"

         data-id="tls_policy"

         data-api-url='edit/tls_policy'

         data-api-url='edit/tls_policy'

         data-api-attr='{"tls_enforce_out":<?=($get_tls_policy['tls_enforce_out'] == "1") ? "0" : "1";?>}'><?=$lang['user']['tls_enforce_out'];?></button>

         data-api-attr='{"tls_enforce_out":<?=($get_tls_policy['tls_enforce_out'] == "1") ? "0" : "1";?>}'><?=$lang['user']['tls_enforce_out'];?></button>

@@ -225,7 +225,7 @@ elseif (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == '
 
   <div class="row">

   <div class="row">

     <div class="col-md-3 col-xs-5 text-right"><?=$lang['user']['eas_reset'];?>:</div>

     <div class="col-md-3 col-xs-5 text-right"><?=$lang['user']['eas_reset'];?>:</div>

     <div class="col-md-9 col-xs-7">

     <div class="col-md-9 col-xs-7">

-    <button class="btn btn-xs btn-default" id="delete_selected" data-text="<?=$lang['user']['eas_reset'];?>?" data-item="<?= $username; ?>" data-id="eas_cache" data-api-url='delete/eas_cache' href="#"><?=$lang['user']['eas_reset_now'];?></button>

+    <button class="btn btn-xs btn-default" id="delete_selected" data-text="<?=$lang['user']['eas_reset'];?>?" data-item="<?= htmlentities($username); ?>" data-id="eas_cache" data-api-url='delete/eas_cache' href="#"><?=$lang['user']['eas_reset_now'];?></button>

     <p class="help-block"><?=$lang['user']['eas_reset_help'];?></p>

     <p class="help-block"><?=$lang['user']['eas_reset_help'];?></p>

     </div>

     </div>

   </div>

   </div>

@@ -315,7 +315,7 @@ elseif (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == '
 
       <div class="form-group">

       <div class="form-group">

 				<div class="col-sm-10">

 				<div class="col-sm-10">

         <button type="button" class="btn btn-sm btn-success" id="edit_selected"

         <button type="button" class="btn btn-sm btn-success" id="edit_selected"

-          data-item="<?= $username; ?>"

+          data-item="<?= htmlentities($username); ?>"

           data-id="spam_score"

           data-id="spam_score"

           data-api-url='edit/spam-score'

           data-api-url='edit/spam-score'

           data-api-attr='{}'><?=$lang['user']['save_changes'];?></button>

           data-api-attr='{}'><?=$lang['user']['save_changes'];?></button>

@@ -346,7 +346,7 @@ elseif (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == '
 
           <div class="input-group">

           <div class="input-group">

             <input type="text" class="form-control" name="object_from" id="object_from" placeholder="*@example.org" required>

             <input type="text" class="form-control" name="object_from" id="object_from" placeholder="*@example.org" required>

             <span class="input-group-btn">

             <span class="input-group-btn">

-              <button class="btn btn-default" id="add_item" data-id="add_wl_policy_mailbox" data-api-url='add/mailbox-policy' data-api-attr='{"username":"<?= $username; ?>","object_list":"wl"}' href="#"><span class="glyphicon glyphicon-plus"></span> <?=$lang['user']['spamfilter_table_add'];?></button>

+              <button class="btn btn-default" id="add_item" data-id="add_wl_policy_mailbox" data-api-url='add/mailbox-policy' data-api-attr='{"username":<?= json_encode($username); ?>,"object_list":"wl"}' href="#"><span class="glyphicon glyphicon-plus"></span> <?=$lang['user']['spamfilter_table_add'];?></button>

             </span>

             </span>

           </div>

           </div>

         </form>

         </form>

@@ -372,10 +372,10 @@ elseif (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == '
 
         <form class="form-inline" data-id="add_bl_policy_mailbox">

         <form class="form-inline" data-id="add_bl_policy_mailbox">

           <div class="input-group">

           <div class="input-group">

             <input type="text" class="form-control" name="object_from" id="object_from" placeholder="*@example.org" required>

             <input type="text" class="form-control" name="object_from" id="object_from" placeholder="*@example.org" required>

-            <input type="hidden" name="username" value="<?= $username ;?>">

+            <input type="hidden" name="username" value="<?= htmlentities($username) ;?>">

             <input type="hidden" name="object_list" value="bl">

             <input type="hidden" name="object_list" value="bl">

             <span class="input-group-btn">

             <span class="input-group-btn">

-              <button class="btn btn-default" id="add_item" data-id="add_bl_policy_mailbox" data-api-url='add/mailbox-policy' data-api-attr='{"username":"<?= $username; ?>","object_list":"bl"}' href="#"><span class="glyphicon glyphicon-plus"></span> <?=$lang['user']['spamfilter_table_add'];?></button>

+              <button class="btn btn-default" id="add_item" data-id="add_bl_policy_mailbox" data-api-url='add/mailbox-policy' data-api-attr='{"username":<?= json_encode($username); ?>,"object_list":"bl"}' href="#"><span class="glyphicon glyphicon-plus"></span> <?=$lang['user']['spamfilter_table_add'];?></button>

             </span>

             </span>

           </div>

           </div>

         </form>

         </form>