8bb069e996
exposing xss clean method on templateutilities. making the clean xss string extensions public instead of internal. ensuring the included grid renderers clean for xss. ensuring the included grid editors using html.raw with value directly, cleans for xss.
91 lines
2.9 KiB
Plaintext
91 lines
2.9 KiB
Plaintext
@inherits UmbracoViewPage<dynamic>
|
|
@using Umbraco.Web.Templates
|
|
@using Newtonsoft.Json.Linq
|
|
|
|
@*
|
|
Razor helpers located at the bottom of this file
|
|
*@
|
|
|
|
@if (Model != null && Model.sections != null)
|
|
{
|
|
var oneColumn = ((System.Collections.ICollection)Model.sections).Count == 1;
|
|
|
|
<div class="umb-grid">
|
|
@if (oneColumn)
|
|
{
|
|
foreach (var section in Model.sections) {
|
|
<div class="grid-section">
|
|
@foreach (var row in section.rows) {
|
|
@renderRow(row);
|
|
}
|
|
</div>
|
|
}
|
|
}else {
|
|
<div class="row clearfix">
|
|
@foreach (var s in Model.sections) {
|
|
<div class="grid-section">
|
|
<div class="col-md-@s.grid column">
|
|
@foreach (var row in s.rows) {
|
|
@renderRow(row);
|
|
}
|
|
</div>
|
|
</div>
|
|
}
|
|
</div>
|
|
}
|
|
</div>
|
|
}
|
|
|
|
@helper renderRow(dynamic row){
|
|
<div @RenderElementAttributes(row)>
|
|
<div class="row clearfix">
|
|
@foreach ( var area in row.areas ) {
|
|
<div class="col-md-@area.grid column">
|
|
<div @RenderElementAttributes(area)>
|
|
@foreach (var control in area.controls) {
|
|
if (control !=null && control.editor != null && control.editor.view != null ) {
|
|
<text>@Html.Partial("grid/editors/base", (object)control)</text>
|
|
}
|
|
}
|
|
</div>
|
|
</div>}
|
|
</div>
|
|
</div>
|
|
}
|
|
|
|
@functions {
|
|
public static MvcHtmlString RenderElementAttributes(dynamic contentItem)
|
|
{
|
|
var attrs = new List<string>();
|
|
JObject cfg = contentItem.config;
|
|
|
|
if(cfg != null)
|
|
foreach (JProperty property in cfg.Properties())
|
|
{
|
|
var propertyValue = TemplateUtilities.CleanForXss(property.Value.ToString());
|
|
if (string.IsNullOrWhiteSpace(propertyValue) == false)
|
|
{
|
|
attrs.Add(property.Name + "='" + propertyValue + "'");
|
|
}
|
|
}
|
|
|
|
JObject style = contentItem.styles;
|
|
|
|
if (style != null) {
|
|
var cssVals = new List<string>();
|
|
foreach (JProperty property in style.Properties())
|
|
{
|
|
var propertyValue = TemplateUtilities.CleanForXss(property.Value.ToString());
|
|
if (string.IsNullOrWhiteSpace(propertyValue) == false)
|
|
{
|
|
cssVals.Add(property.Name + ":" + propertyValue + ";");
|
|
}
|
|
}
|
|
|
|
if (cssVals.Any())
|
|
attrs.Add("style='" + string.Join(" ", cssVals) + "'");
|
|
}
|
|
|
|
return new MvcHtmlString(string.Join(" ", attrs));
|
|
}
|
|
} |