Update

- Added : sanitizing user input

Author: Blair2004

app/Forms/UserProfileForm.php

@@ -59,7 +59,7 @@ public function processAttribute( $request )
 
             foreach( $request->input( 'attribute' ) as $key => $value ) {
                 if ( in_array( $key, $allowedInputs ) ) {
-                    $user->$key     =   $value;
+                    $user->$key     =   preg_replace( '#<script(.*?)>(.*?)</script>#is', '', $value );
                 }
             }
 
@@ -76,6 +76,9 @@ public function processAttribute( $request )
 
     public function processOptions( $request )
     {
+        /**
+         * @var UserOptions
+         */
         $userOptions    =   app()->make( UserOptions::class );
 
         if ( $request->input( 'options' ) ) {

app/Http/Controllers/Dashboard/CrudController.php

@@ -114,6 +114,12 @@ public function crudPost( String $namespace, CrudPostRequest $request )
                     $entry->$name   =   $value;
                 }
             }
+
+            /**
+             * sanitizing input to remove
+             * all script tags
+             */
+            $entry->$name       =   preg_replace( '#<script(.*?)>(.*?)</script>#is', '', $entry->$name );
         }
 
         /**
@@ -229,6 +235,12 @@ public function crudPut( String $namespace, $id, CrudPutRequest $request  )
                     $entry->$name   =   $value;
                 }
             }
+
+            /**
+             * sanitizing input to remove
+             * all script tags
+             */
+            $entry->$name       =   preg_replace( '#<script(.*?)>(.*?)</script>#is', '', $entry->$name );
         }
 
         /**

app/Services/Options.php

@@ -61,7 +61,7 @@ public function set( $key, $value, $expiration = null )
     {
         $this->hasFound     =   false;
         $storedOption       =   null;
-        
+
         /**
          * if an option has been found,
          * it will save the new value and update
@@ -150,6 +150,12 @@ public function set( $key, $value, $expiration = null )
 
     public function beforeSave( $option )
     {
+        /**
+        * sanitizing input to remove
+        * all script tags
+        */
+        $option->value      =   preg_replace( '#<script(.*?)>(.*?)</script>#is', '', $option->value );
+
         return $option;
     }
 

app/Services/SettingsPage.php

@@ -107,6 +107,10 @@ public function getPlainData( Request $request )
     public function saveForm( Request $request )
     {
         $service        =   new CrudService;
+
+        /**
+         * @var Options
+         */
         $options        =   app()->make( Options::class );
 
         foreach( $service->getPlainData( $this, $request ) as $key => $value ) {

app/Services/UserOptions.php

@@ -22,6 +22,13 @@ public function option()
     public function beforeSave( $option )
     {
         $option->user_id    =   $this->user_id;
+        
+        /**
+        * sanitizing input to remove
+        * all script tags
+        */
+        $option->value      =   preg_replace( '#<script(.*?)>(.*?)</script>#is', '', $option->value );   
+
         return $option;
     }
 }

public/js/app.js

@@ -18,8 +18,8 @@ eval("// removed by extract-text-webpack-plugin//# sourceURL=[module]\n//# sourc
 /*! no static exports found */
 /***/ (function(module, exports, __webpack_require__) {
 
-__webpack_require__(/*! D:\laragon\www\NexoPOS-4x\resources\ts\bootstrap.ts */"./resources/ts/bootstrap.ts");
-module.exports = __webpack_require__(/*! D:\laragon\www\NexoPOS-4x\resources\sass\app.scss */"./resources/sass/app.scss");
+__webpack_require__(/*! /var/www/html/NexoPOS-v4/resources/ts/bootstrap.ts */"./resources/ts/bootstrap.ts");
+module.exports = __webpack_require__(/*! /var/www/html/NexoPOS-v4/resources/sass/app.scss */"./resources/sass/app.scss");
 
 
 /***/ })