gitmedia/presseportale
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

security: Stored-XSS über page_url im Kontaktformular schließen (H3)

Browse source 
page_url aus dem anonymen Kontaktformular wird auf url:http,https
validiert; das Admin-Backend rendert nur http(s)-Links klickbar, sonst
als Text. Verhindert javascript:-URIs, die beim Admin-Klick im
Admin-Kontext liefen.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Kevin Adametz 2026-07-14 13:49:05 +00:00
parent 77f8f9cb35
commit 8f517e993d
3 changed files with 43 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

16
resources/views/livewire/admin/contact-messages/show.blade.php
View file

@ -24,22 +24,30 @@ new #[Layout('components.layouts.app'), Title('Anliegen · Kontakt')] class exte
public function markInProgress(): void
{
$this->authorize('compliance:manage');
$this->message()->update(['status' => ContactMessageStatus::InProgress->value]);
$this->notification = __('Status auf „In Bearbeitung" gesetzt.');
}
public function resolve(): void
{
$this->authorize('compliance:manage');
$this->finish(ContactMessageStatus::Resolved, __('Anliegen als erledigt markiert.'));
}
public function reject(): void
{
$this->authorize('compliance:manage');
$this->finish(ContactMessageStatus::Rejected, __('Anliegen abgelehnt.'));
}
public function reopen(): void
{
$this->authorize('compliance:manage');
$this->message()->update([
'status' => ContactMessageStatus::Open->value,
'resolved_by_user_id' => null,
@ -163,8 +171,12 @@ new #[Layout('components.layouts.app'), Title('Anliegen · Kontakt')] class exte
<div class="sm:col-span-2">
<dt class="text-[11px] uppercase tracking-[0.6px] text-[color:var(--color-ink-3)] font-semibold mb-1">{{ __('Abgesendet von Seite') }}</dt>
<dd class="text-[color:var(--color-ink)]">
<a href="{{ $message->page_url }}" target="_blank" rel="noopener"
class="text-[color:var(--color-hub)] underline underline-offset-2 break-all">{{ $message->page_url }}</a>
@if (str($message->page_url)->startsWith(['http://', 'https://']))
<a href="{{ $message->page_url }}" target="_blank" rel="noopener"
class="text-[color:var(--color-hub)] underline underline-offset-2 break-all">{{ $message->page_url }}</a>
@else
<span class="break-all">{{ $message->page_url }}</span>
@endif
</dd>
</div>
@endif