mirrors/jellyfin-web
1
0
Fork 0
mirror of https://github.com/jellyfin/jellyfin-web synced 2025-03-30 19:56:21 +00:00
Code Activity

Backport pull request #5563 from jellyfin-web/release-10.9.z

Browse source 
Fix chapter name XSS injection in progress bar

Original-merge: 7eb54e029f

Merged-by: thornbill <thornbill@users.noreply.github.com>

Backported-by: Joshua M. Boniface <joshua@boniface.me>
This commit is contained in:
nielsvanvelzen 2024-05-25 11:50:39 -04:00 • committed by Joshua M. Boniface
parent 94f34ddd13
commit 9cf57574fb
2 changed files with 2 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

1
src/controllers/playback/video/index.js
View file

@ -1843,7 +1843,6 @@ export default function (view) {
if (item?.Chapters?.length) {
item.Chapters.forEach(currentChapter => {
markers.push({
className: 'chapterMarker',
name: currentChapter.Name,
progress: currentChapter.StartPositionTicks / item.RunTimeTicks
});

19
src/elements/emby-slider/emby-slider.js
View file

@ -203,28 +203,13 @@ function setMarker(range, valueMarker, marker, valueProgress) {
}
function updateMarkers(range, currentValue) {
function getMarkerHtml(markerInfo) {
let markerTypeSpecificClasses = '';
if (markerInfo.className === 'chapterMarker') {
markerTypeSpecificClasses = markerInfo.className;
if (typeof markerInfo.name === 'string' && markerInfo.name.length) {
// limit the class length in case the name contains half a novel
markerTypeSpecificClasses = `${markerInfo.className} marker-${markerInfo.name.substring(0, 100).toLowerCase().replace(' ', '-')}`;
}
}
return `<span class="material-icons sliderMarker ${markerTypeSpecificClasses}" aria-hidden="true"></span>`;
}
if (range.getMarkerInfo) {
range.markerInfo = range.getMarkerInfo();
range.markerContainerElement.innerHTML = '';
range.markerInfo.forEach(info => {
range.markerContainerElement.insertAdjacentHTML('beforeend', getMarkerHtml(info));
range.markerInfo.forEach(() => {
range.markerContainerElement.insertAdjacentHTML('beforeend', '<span class="sliderMarker" aria-hidden="true"></span>');
});
range.markerElements = range.markerContainerElement.querySelectorAll('.sliderMarker');