ufo / ufo-platform · Commits

Go to a project

Authored by mali
Commit 2ddd893e25697de5e9d9ac245816fb90a951a2a4 1 parent 6e63fb67

http://qmc.yohops.com/onlinebug/detail?id=641 xss攻击

Inline Side-by-side
Showing 3 changed files with 18 additions and 9 deletions
@@ -141,11 +141,11 @@ function getDetailInfo(id){ @@ -141,11 +141,11 @@ function getDetailInfo(id){
141 dataType: 'json', 141 dataType: 'json',
142 success: function (result) { 142 success: function (result) {
143 if(result.code == 200) { 143 if(result.code == 200) {
144 - $("#brandValue").html(result.data.brand);  
145 - $("#productNameValue").html(result.data.productName); 144 + $("#brandValue").html(result.data.brand.replace(/</ig, '&lt;').replace(/>/ig, '&gt;'));
  145 + $("#productNameValue").html(result.data.productName.replace(/</ig, '&lt;').replace(/>/ig, '&gt;'));
146 $("#priceValue").html(result.data.price); 146 $("#priceValue").html(result.data.price);
147 $("#saleTimeValue").html(result.data.saleTime); 147 $("#saleTimeValue").html(result.data.saleTime);
148 - $("#productCodeValue").html(result.data.productCode); 148 + $("#productCodeValue").html(result.data.productCode.replace(/</ig, '&lt;').replace(/>/ig, '&gt;'));
149 var imageStr = ""; 149 var imageStr = "";
150 for (var i=0;i<result.data.imageList.length;i++){ 150 for (var i=0;i<result.data.imageList.length;i++){
151 imageStr += "<img height='132px;' width='211px;' class='pimg' src='"+result.data.imageList[i]+"'/>"; 151 imageStr += "<img height='132px;' width='211px;' class='pimg' src='"+result.data.imageList[i]+"'/>";
@@ -100,12 +100,18 @@ function loadMainList(){ @@ -100,12 +100,18 @@ function loadMainList(){
100 title: "品牌*", 100 title: "品牌*",
101 field: "brand", 101 field: "brand",
102 width: 20, 102 width: 20,
103 - align: "center" 103 + align: "center",
  104 + formatter: function (value, rowData, rowIndex) {
  105 + return value.replace(/</ig, '&lt;').replace(/>/ig, '&gt;');
  106 + }
104 }, { 107 }, {
105 title: "商品名称*", 108 title: "商品名称*",
106 field: "productName", 109 field: "productName",
107 width: 20, 110 width: 20,
108 - align: "center" 111 + align: "center",
  112 + formatter: function (value, rowData, rowIndex) {
  113 + return value.replace(/</ig, '&lt;').replace(/>/ig, '&gt;');
  114 + }
109 }, { 115 }, {
110 title: "发售价", 116 title: "发售价",
111 field: "price", 117 field: "price",
@@ -120,7 +126,10 @@ function loadMainList(){ @@ -120,7 +126,10 @@ function loadMainList(){
120 title: "货号*", 126 title: "货号*",
121 field: "productCode", 127 field: "productCode",
122 width: 20, 128 width: 20,
123 - align: "center" 129 + align: "center",
  130 + formatter: function (value, rowData, rowIndex) {
  131 + return value.replace(/</ig, '&lt;').replace(/>/ig, '&gt;');
  132 + }
124 }, { 133 }, {
125 title: "创建时间", 134 title: "创建时间",
126 field: "createTimeStr", 135 field: "createTimeStr",
@@ -106,11 +106,11 @@ function getDetailInfo(id){ @@ -106,11 +106,11 @@ function getDetailInfo(id){
106 dataType: 'json', 106 dataType: 'json',
107 success: function (result) { 107 success: function (result) {
108 if(result.code == 200) { 108 if(result.code == 200) {
109 - $("#brandValue").html(result.data.brand);  
110 - $("#productNameValue").html(result.data.productName); 109 + $("#brandValue").html(result.data.brand.replace(/</ig, '&lt;').replace(/>/ig, '&gt;'));
  110 + $("#productNameValue").html(result.data.productName.replace(/</ig, '&lt;').replace(/>/ig, '&gt;'));
111 $("#priceValue").html(result.data.price); 111 $("#priceValue").html(result.data.price);
112 $("#saleTimeValue").html(result.data.saleTime); 112 $("#saleTimeValue").html(result.data.saleTime);
113 - $("#productCodeValue").html(result.data.productCode); 113 + $("#productCodeValue").html(result.data.productCode.replace(/</ig, '&lt;').replace(/>/ig, '&gt;'));
114 var imageStr = ""; 114 var imageStr = "";
115 for (var i=0;i<result.data.imageList.length;i++){ 115 for (var i=0;i<result.data.imageList.length;i++){
116 imageStr += "<img height='132px;' width='211px;' class='pimg' src='"+result.data.imageList[i]+"'/>"; 116 imageStr += "<img height='132px;' width='211px;' class='pimg' src='"+result.data.imageList[i]+"'/>";