Files
Umbraco-CMS/src/Umbraco.Web.UI/Views/Partials/Grid/Bootstrap3-Fluid.cshtml
T
Claus 8bb069e996 U4-9134 XSS security issue in the grid
exposing xss clean method on templateutilities.
making the clean xss string extensions public instead of internal.
ensuring the included grid renderers clean for xss.
ensuring the included grid editors using html.raw with value directly, cleans for xss.
2016-11-08 09:55:24 +01:00

91 lines
2.9 KiB
Plaintext

@inherits UmbracoViewPage<dynamic>
@using Umbraco.Web.Templates
@using Newtonsoft.Json.Linq
@*
Razor helpers located at the bottom of this file
*@
@if (Model != null && Model.sections != null)
{
var oneColumn = ((System.Collections.ICollection)Model.sections).Count == 1;
<div class="umb-grid">
@if (oneColumn)
{
foreach (var section in Model.sections) {
<div class="grid-section">
@foreach (var row in section.rows) {
@renderRow(row);
}
</div>
}
}else {
<div class="row clearfix">
@foreach (var s in Model.sections) {
<div class="grid-section">
<div class="col-md-@s.grid column">
@foreach (var row in s.rows) {
@renderRow(row);
}
</div>
</div>
}
</div>
}
</div>
}
@helper renderRow(dynamic row){
<div @RenderElementAttributes(row)>
<div class="row clearfix">
@foreach ( var area in row.areas ) {
<div class="col-md-@area.grid column">
<div @RenderElementAttributes(area)>
@foreach (var control in area.controls) {
if (control !=null && control.editor != null && control.editor.view != null ) {
<text>@Html.Partial("grid/editors/base", (object)control)</text>
}
}
</div>
</div>}
</div>
</div>
}
@functions {
public static MvcHtmlString RenderElementAttributes(dynamic contentItem)
{
var attrs = new List<string>();
JObject cfg = contentItem.config;
if(cfg != null)
foreach (JProperty property in cfg.Properties())
{
var propertyValue = TemplateUtilities.CleanForXss(property.Value.ToString());
if (string.IsNullOrWhiteSpace(propertyValue) == false)
{
attrs.Add(property.Name + "='" + propertyValue + "'");
}
}
JObject style = contentItem.styles;
if (style != null) {
var cssVals = new List<string>();
foreach (JProperty property in style.Properties())
{
var propertyValue = TemplateUtilities.CleanForXss(property.Value.ToString());
if (string.IsNullOrWhiteSpace(propertyValue) == false)
{
cssVals.Add(property.Name + ":" + propertyValue + ";");
}
}
if (cssVals.Any())
attrs.Add("style='" + string.Join(" ", cssVals) + "'");
}
return new MvcHtmlString(string.Join(" ", attrs));
}
}