diff options
| author | tobtoht <tob@featherwallet.org> | 2026-06-22 22:03:43 +0000 |
|---|---|---|
| committer | tobtoht <tob@featherwallet.org> | 2026-06-22 22:03:43 +0000 |
| commit | 0e78e60cd799aaa207125c0c51278f0d481e9dea (patch) | |
| tree | e6ecf52ab97b2f6807f39caec3f523a8fed6fa69 | |
| parent | 09fd2997da78f1230f5b123f675285fa3b3ccad2 (diff) | |
| parent | 3d3a391ef43b1ac09160f4d572d5fbf85f249dc8 (diff) | |
| download | monzero-gui-0e78e60cd799aaa207125c0c51278f0d481e9dea.tar.gz monzero-gui-0e78e60cd799aaa207125c0c51278f0d481e9dea.tar.xz monzero-gui-0e78e60cd799aaa207125c0c51278f0d481e9dea.zip | |
Merge pull request #4610
3d3a391 qml: escape untrusted text in remaining RichText views (Thomas)
ACKs: selsta
| -rw-r--r-- | components/TxConfirmationDialog.qml | 5 | ||||
| -rw-r--r-- | pages/History.qml | 2 | ||||
| -rw-r--r-- | pages/merchant/Merchant.qml | 2 | ||||
| -rw-r--r-- | pages/settings/SettingsInfo.qml | 2 |
4 files changed, 6 insertions, 5 deletions
diff --git a/components/TxConfirmationDialog.qml b/components/TxConfirmationDialog.qml index 1700aa0a..51da022f 100644 --- a/components/TxConfirmationDialog.qml +++ b/components/TxConfirmationDialog.qml @@ -242,6 +242,7 @@ Rectangle { Layout.fillWidth: true font.pixelSize: 15 color: MoneroComponents.Style.defaultFontColor + textFormat: Text.RichText text: { if (currentWallet) { var walletTitle = function() { @@ -257,9 +258,9 @@ Rectangle { if (appWindow.currentWallet.numSubaddressAccounts() > 1) { var currentSubaddressAccount = currentWallet.currentSubaddressAccount; var currentAccountLabel = currentWallet.getSubaddressLabel(currentWallet.currentSubaddressAccount, 0); - return walletTitle() + " (" + walletName + ")" + "<br>" + qsTr("Account #") + currentSubaddressAccount + (currentAccountLabel !== "" ? " (" + currentAccountLabel + ")" : "") + translationManager.emptyString; + return walletTitle() + " (" + Utils.htmlEscape(walletName) + ")" + "<br>" + qsTr("Account #") + currentSubaddressAccount + (currentAccountLabel !== "" ? " (" + Utils.htmlEscape(currentAccountLabel) + ")" : "") + translationManager.emptyString; } else { - return walletTitle() + " (" + walletName + ")" + translationManager.emptyString; + return walletTitle() + " (" + Utils.htmlEscape(walletName) + ")" + translationManager.emptyString; } } else { return ""; diff --git a/pages/History.qml b/pages/History.qml index d9132e3b..6871405d 100644 --- a/pages/History.qml +++ b/pages/History.qml @@ -1746,7 +1746,7 @@ Rectangle { + (paymentId ? trStart + qsTr("Payment ID:") + trMiddle + paymentId + trEnd : "") + (integratedAddress ? trStart + qsTr("Integrated address") + ":" + trMiddle + integratedAddress + trEnd : "") + (tx_key ? trStart + qsTr("Tx key:") + trMiddle + tx_key + trEnd : "") - + (tx_note ? trStart + qsTr("Tx note:") + trMiddle + tx_note + trEnd : "") + + (tx_note ? trStart + qsTr("Tx note:") + trMiddle + Utils.htmlEscape(tx_note) + trEnd : "") + (destinations ? trStart + qsTr("Destinations:") + trMiddle + destinations + trEnd : "") + (rings ? trStart + qsTr("Rings:") + trMiddle + rings + trEnd : "") + "</table>" diff --git a/pages/merchant/Merchant.qml b/pages/merchant/Merchant.qml index 560484b1..86d47560 100644 --- a/pages/merchant/Merchant.qml +++ b/pages/merchant/Merchant.qml @@ -295,7 +295,7 @@ Item { color: "white" text: "<style type='text/css'>a {text-decoration: none; color: #FF6C3C; font-size: 12px;}</style>%1: %2 <a href='#'>(%3)</a>" .arg(qsTr("Currently selected address")) - .arg(addressLabel) + .arg(Utils.htmlEscape(addressLabel)) .arg(qsTr("Change")) + translationManager.emptyString textFormat: Text.RichText themeTransition: false diff --git a/pages/settings/SettingsInfo.qml b/pages/settings/SettingsInfo.qml index ad152d63..e126383a 100644 --- a/pages/settings/SettingsInfo.qml +++ b/pages/settings/SettingsInfo.qml @@ -142,7 +142,7 @@ Rectangle { <style type='text/css'>\ a {cursor:pointer;text-decoration: none; color: #FF6C3C}\ </style>\ - <a href='#'>%1</a>".arg(walletPath) + <a href='#'>%1</a>".arg(Utils.htmlEscape(walletPath)) textFormat: Text.RichText onLinkActivated: oshelper.openContainingFolder(walletPath) |