github
/
layui
mirror of https://github.com/layui/layui
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

fix(tree): 修复编辑节点标题时的 xss 问题 (#1845)

pull/1848/head
贤心 2024-04-29 20:08:00 +08:00 committed by GitHub
parent 54e35f2204
commit 0e31264812
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/modules/tree.js
View File

@ -551,7 +551,7 @@ layui.define(['form','util'], function(exports){
elemMain.children('.layui-tree-editInput').val(util.unescape(text)).focus(); elemMain.children('.layui-tree-editInput').val(util.unescape(text)).focus();
// 嵌入文字移除输入框 // 嵌入文字移除输入框
var getVal = function(input){ var getVal = function(input){
var textNew = input.val().trim(); var textNew = util.escape(input.val().trim());
textNew = textNew ? textNew : options.text.defaultNodeName; textNew = textNew ? textNew : options.text.defaultNodeName;
input.remove(); input.remove();
elemMain.children('.'+ ELEM_TEXT).html(textNew); elemMain.children('.'+ ELEM_TEXT).html(textNew);
@ -862,4 +862,4 @@ layui.define(['form','util'], function(exports){
}; };
exports(MOD_NAME, tree); exports(MOD_NAME, tree);
}) })