all repos — caroster @ 8d70ecab1b49b1a63ffa379b2fadc2807ff9ea28

[Octree] Group carpool to your event https://caroster.io

fix:đŸ”’ïžFix XSS with locales
Tim Izzo tim@octree.ch
Tue, 10 Dec 2024 10:27:42 +0100
commit

8d70ecab1b49b1a63ffa379b2fadc2807ff9ea28

parent

f3511f2779032e0280e592bc77adefcaac5b9abb

M frontend/containers/AddToMyEventDialog/index.tsxfrontend/containers/AddToMyEventDialog/index.tsx

@@ -10,7 +10,7 @@ import Icon from '@mui/material/Icon';

import Slide from '@mui/material/Slide'; import Button from '@mui/material/Button'; import IconButton from '@mui/material/IconButton'; -import {useTranslation} from 'next-i18next'; +import {Trans, useTranslation} from 'next-i18next'; import useAddToEvents from '../../hooks/useAddToEvents'; const PREFIX = 'AddToMyEventDialog';

@@ -49,13 +49,13 @@ <DialogTitle>

{t('event.add_to_my_events.title', {eventName: event.name})} </DialogTitle> <DialogContent> - <DialogContentText - dangerouslySetInnerHTML={{ - __html: t('event.add_to_my_events.text_html', { - eventName: event.name, - }), - }} - /> + <DialogContentText> + <Trans + i18nKey="event.add_to_my_events.text" + values={{eventName: event.name}} + components={{bold: <strong />}} + /> + </DialogContentText> </DialogContent> <DialogActions> <Button
M frontend/locales/de.jsonfrontend/locales/de.json

@@ -276,7 +276,7 @@ "notification.type.NewPassengerInYourTrip.content": "Ein Passagier wurde zu Ihrer Fahrt hinzugefĂŒgt.",

"event.loginToSetAlert": "Die Benachrichtigungen sind nur fĂŒr die Teilnehmer dieser Fahrgemeinschaft verfĂŒgbar.", "lost_password.error": "Diese E-Mail existiert nicht", "notification.type.PassengerJoinTrip.content": "Ein neuer Passagier möchte Sie kontaktieren, um mit Ihnen zu reisen.", - "event.add_to_my_events.text_html": "Um <strong> {{eventName}}</strong> zu Ihren Veranstaltern hinzuzufĂŒgen, mĂŒssen Sie eingeloggt sein oder ein Konto erstellen.", + "event.add_to_my_events.text": "Um <bold>{{eventName}}</bold> zu Ihren Veranstaltern hinzuzufĂŒgen, mĂŒssen Sie eingeloggt sein oder ein Konto erstellen.", "confirm.creating": "Erstellen des Kontos", "options.plus.deleteAdminError": "Es ist ein Fehler aufgetreten", "signin.email": "E-Mail",
M frontend/locales/en.jsonfrontend/locales/en.json

@@ -35,7 +35,7 @@ "event.actions.noShareCapability": "Your browser cannot share nor copy to clipboard, please copy the page's URL instead.",

"event.actions.share": "Share the Caroster", "event.add_to_my_events.login": "$t(menu.login)", "event.add_to_my_events.register": "$t(menu.register)", - "event.add_to_my_events.text_html": "To add <strong> {{eventName}} </strong> to your carosters you must be logged in or create an account.", + "event.add_to_my_events.text": "To add <bold>{{eventName}}</bold> to your carosters you must be logged in or create an account.", "event.add_to_my_events.title": "You must be logged in", "event.creation.addFromAccount.actions.login": "$t(menu.login)", "event.creation.addFromAccount.actions.register": "$t(menu.register)",
M frontend/locales/fr.jsonfrontend/locales/fr.json

@@ -35,7 +35,7 @@ "event.actions.noShareCapability": "Votre navigateur ne permet pas de partager ou de copier dans le presse papier, veuillez copier l'URL de la page.",

"event.actions.share": "Partager le Caroster", "event.add_to_my_events.login": "$t(menu.login)", "event.add_to_my_events.register": "$t(menu.register)", - "event.add_to_my_events.text_html": "Pour ajouter <strong>{{eventName}}</strong> Ă  vos carosters vous devez ĂȘtre connectĂ© ou crĂ©er un compte.", + "event.add_to_my_events.text": "Pour ajouter <bold>{{eventName}}</bold> Ă  vos carosters vous devez ĂȘtre connectĂ© ou crĂ©er un compte.", "event.add_to_my_events.title": "Vous devez ĂȘtre connectĂ©", "event.creation.addFromAccount.actions.login": "$t(menu.login)", "event.creation.addFromAccount.actions.register": "$t(menu.register)",
M frontend/locales/it.jsonfrontend/locales/it.json

@@ -107,7 +107,7 @@ "confirm.text": "Ti abbiamo inviato un link via email. Cliccalo per confermare la creazione account.",

"dashboard.noEvent.text_html": "Qui troverai <strong> i Caroster ai quali partecipi </strong>, per iniziare a creare un Caroster!", "event.actions.share": "Condividi il Caroster", "signin.email": "Email", - "event.add_to_my_events.text_html": "Per aggiungere <strong> {{eventName}} </strong> ai tuoi caroster devi effettuare l'accesso o creare un account.", + "event.add_to_my_events.text": "Per aggiungere <bold>{{eventName}}</bold> ai tuoi caroster devi effettuare l'accesso o creare un account.", "event.loginToSetAlert": "Gli avvisi sono disponibili solo a chi partecipa al carpool.", "passenger.success.added_self_to_car": "Sei stato aggiunto al passaggio", "travel.passengers.location_placeholder": "Luogo d'incontro (facoltativo)",
M frontend/locales/nl.jsonfrontend/locales/nl.json

@@ -35,7 +35,7 @@ "event.actions.noShareCapability": "Uw browser heeft geen klembordondersteuning - kopieer de pagina-url.",

"event.actions.share": "Delen het Caroster", "event.add_to_my_events.login": "$t(menu.login)", "event.add_to_my_events.register": "$t(menu.register)", - "event.add_to_my_events.text_html": "U kunt <strong>{{eventName}}</strong> alleen toevoegen aan uw carosters als u bent ingelogd.", + "event.add_to_my_events.text": "U kunt <bold>{{eventName}}</bold> alleen toevoegen aan uw carosters als u bent ingelogd.", "event.add_to_my_events.title": "U dient ingelogd te zijn", "event.creation.addFromAccount.actions.login": "$t(menu.login)", "event.creation.addFromAccount.actions.register": "$t(menu.register)",
M frontend/locales/pl.jsonfrontend/locales/pl.json

@@ -34,7 +34,7 @@ "event.actions.noShareCapability": "",

"event.actions.share": "", "event.add_to_my_events.login": "$t(menu.login)", "event.add_to_my_events.register": "$t(menu.register)", - "event.add_to_my_events.text_html": "", + "event.add_to_my_events.text": "", "event.add_to_my_events.title": "", "event.creation.addFromAccount.actions.login": "$t(menu.login)", "event.creation.addFromAccount.actions.register": "$t(menu.register)",
M frontend/locales/sv.jsonfrontend/locales/sv.json

@@ -25,7 +25,7 @@ "event.actions.noShareCapability": "",

"event.actions.share": "", "event.add_to_my_events.login": "$t(menu.login)", "event.add_to_my_events.register": "$t(menu.register)", - "event.add_to_my_events.text_html": "", + "event.add_to_my_events.text": "", "event.add_to_my_events.title": "", "event.creation.addFromAccount.actions.login": "", "event.creation.addFromAccount.actions.register": "",