122672: Убрали обработку скриптов в полях пользовательского ввода

src/nginxconfig/generators/conf/security.conf.js

@@ -56,10 +56,9 @@ export default (domains, global) => {
         config.push(['location /security.txt', {
             return: '301 /.well-known/security.txt',
         }]);
-        
         // Custom security.txt path
         config.push(['location = /.well-known/security.txt', {
-            alias: `${global.security.securityTxtPath.value}`,
+            alias: `${global.security.securityTxtPath.computed}`,
         }]);
     }
 

src/nginxconfig/templates/domain_sections/restrict.vue

@@ -279,6 +279,11 @@ THE SOFTWARE.
         watch: {
             '$props.data.responseCode': {
                 handler(data) {
+                    if( typeof data.computed === 'string' ) {
+                        data.computed = data.computed.replaceAll(/</g, '&lt;');
+                        data.computed = data.computed.replaceAll(/>/g, '&gt;');
+                    }
+
                     if (data.computed && /^[1-5][0-9][0-9]$/.test(data.computed)) {
                         this.validResponseCode = true;
                     } else {

src/nginxconfig/templates/domain_sections/reverse_proxy.vue

@@ -137,6 +137,9 @@ THE SOFTWARE.
             // If the PHP or Python is enabled, the Reverse proxy will be forced off
             '$parent.$props.data': {
                 handler(data) {
+                    data.reverseProxy.path.computed = data.reverseProxy.path.computed.replaceAll(/</g, '&lt;');
+                    data.reverseProxy.proxyPass.computed = data.reverseProxy.proxyPass.computed.replaceAll(/>/g, '&gt;');
+
                     // This might cause recursion, but seems not to
                     if (data.php.php.computed || data.python.python.computed) {
                         this.$props.data.reverseProxy.enabled = false;

src/nginxconfig/templates/domain_sections/server.vue

@@ -208,8 +208,8 @@ THE SOFTWARE.
         watch: {
             '$props.data.domain': {
                 handler(data) {
-                    data.computed = data.computed.replace(/</, '&lt;');
+                    data.computed = data.computed.replaceAll(/</g, '&lt;');
-                    data.computed = data.computed.replace(/>/, '&gt;');
+                    data.computed = data.computed.replaceAll(/>/g, '&gt;');
 
                     // Ignore www. if given, enable WWW subdomain
                     if (data.computed.startsWith('www.')) {
@@ -246,8 +246,8 @@ THE SOFTWARE.
             // Ensure there is a default path
             '$props.data.path': {
                 handler(data) {
-                    data.computed = data.computed.replace(/</, '&lt;');
+                    data.computed = data.computed.replaceAll(/</g, '&lt;');
-                    data.computed = data.computed.replace(/>/, '&gt;');
+                    data.computed = data.computed.replaceAll(/>/g, '&gt;');
 
                     if (!data.computed.trim()) {
                         data.computed = `/var/www/${this.$props.data.domain.computed}`;
@@ -257,22 +257,22 @@ THE SOFTWARE.
             },
             '$props.data.documentRoot': {
                 handler(data) {
-                    data.computed = data.computed.replace(/</, '&lt;');
+                    data.computed = data.computed.replaceAll(/</g, '&lt;');
-                    data.computed = data.computed.replace(/>/, '&gt;');
+                    data.computed = data.computed.replaceAll(/>/g, '&gt;');
                 },
                 deep: true,
             },
             '$props.data.listenIpv4': {
                 handler(data) {
-                    data.computed = data.computed.replace(/</, '&lt;');
+                    data.computed = data.computed.replaceAll(/</g, '&lt;');
-                    data.computed = data.computed.replace(/>/, '&gt;');
+                    data.computed = data.computed.replaceAll(/>/g, '&gt;');
                 },
                 deep: true,
             },
             '$props.data.listenIpv6': {
                 handler(data) {
-                    data.computed = data.computed.replace(/</, '&lt;');
+                    data.computed = data.computed.replaceAll(/</g, '&lt;');
-                    data.computed = data.computed.replace(/>/, '&gt;');
+                    data.computed = data.computed.replaceAll(/>/g, '&gt;');
                 },
                 deep: true,
             },

src/nginxconfig/templates/global_sections/https.vue

@@ -374,8 +374,8 @@ THE SOFTWARE.
             },
             '$props.data.letsEncryptCertRoot': {
                 handler(data) {
-                    data.computed = data.computed.replace(/</, '&lt;');
+                    data.computed = data.computed.replaceAll(/</g, '&lt;');
-                    data.computed = data.computed.replace(/>/, '&gt;');
+                    data.computed = data.computed.replaceAll(/>/g, '&gt;');
                 },
                 deep: true,
             },

src/nginxconfig/templates/global_sections/nginx.vue

@@ -207,9 +207,26 @@ THE SOFTWARE.
         },
         computed: computedFromDefaults(defaults, 'nginx'),  // Getters & setters for the delegated data
         watch: {
+            '$props.data.user': {
+                handler(data) {
+                    data.computed = data.computed.replaceAll(/</g, '&lt;');
+                    data.computed = data.computed.replaceAll(/>/g, '&gt;');
+                },
+                deep: true,
+            },
+            '$props.data.pid': {
+                handler(data) {
+                    data.computed = data.computed.replaceAll(/</g, '&lt;');
+                    data.computed = data.computed.replaceAll(/>/g, '&gt;');
+                },
+                deep: true,
+            },
             // Clean nginx directory of trailing slashes
             '$props.data.nginxConfigDirectory': {
                 handler(data) {
+                    // data.computed = data.computed.replaceAll(/</g, '&lt;');
+                    // data.computed = data.computed.replaceAll(/>/g, '&gt;');
+
                     // This might cause recursion, but seems not to
                     if (data.enabled)
                         if (data.computed.endsWith('/'))

src/nginxconfig/templates/global_sections/python.vue

@@ -96,6 +96,13 @@ THE SOFTWARE.
                 },
                 deep: true,
             },
+            '$props.data.pythonServer': {
+                handler(data) {
+                    data.computed = data.computed.replaceAll(/</g, '&lt;');
+                    data.computed = data.computed.replaceAll(/>/g, '&gt;');
+                },
+                deep: true,
+            },
         },
     };
 </script>

src/nginxconfig/templates/global_sections/security.vue

@@ -205,6 +205,20 @@ THE SOFTWARE.
             },
         },
         watch: {
+            '$props.data.securityTxtPath': {
+                handler(data) {
+                    data.computed = data.computed.replaceAll(/</g, '&lt;');
+                    data.computed = data.computed.replaceAll(/>/g, '&gt;');
+                },
+                deep: true,
+            },
+            '$props.data.contentSecurityPolicy': {
+                handler(data) {
+                    data.computed = data.computed.replaceAll(/</g, '&lt;');
+                    data.computed = data.computed.replaceAll(/>/g, '&gt;');
+                },
+                deep: true,
+            },
             // Check referrer policy selection is valid
             '$props.data.referrerPolicy': {
                 handler(data) {