fix XSS

[freeside.git] / FS / FS / UI / Web.pm

diff --git a/FS/FS/UI/Web.pm b/FS/FS/UI/Web.pm
index 821b191..c2ea0a6 100644 (file)
--- a/FS/FS/UI/Web.pm
+++ b/FS/FS/UI/Web.pm
@@ -3,6 +3,8 @@ package FS::UI::Web;
 use strict;
 use vars qw($DEBUG @ISA @EXPORT_OK $me);
 use Exporter;
+use Carp qw( confess );
+use HTML::Entities;
 use FS::Conf;
 use FS::Misc::DateTime qw( parse_datetime );
 use FS::Record qw(dbdef);
@@ -134,7 +136,8 @@ sub svc_link {
 
 sub svc_label_link {
   my($m, $part_svc, $cust_svc) = @_ or return '';
-  svc_X_link( ($cust_svc->label)[1], @_ );
+  my($svc, $label, $svcdb) = $cust_svc->label;
+  svc_X_link( $label, @_ );
 }
 
 sub svc_X_link {
@@ -143,6 +146,9 @@ sub svc_X_link {
   return $x
    unless $FS::CurrentUser::CurrentUser->access_right('View customer services');
 
+  confess "svc_X_link called without a service ($x, $m, $part_svc, $cust_svc)\n"
+    unless $cust_svc;
+
   my $ahref = svc_url(
     'ahref'    => 1,
     'm'        => $m,
@@ -378,7 +384,7 @@ sub cust_fields {
   map { 
     if ( $record->custnum ) {
       warn "  $record -> $_" if $DEBUG > 1;
-      $record->$_(@_);
+      encode_entities( $record->$_(@_) );
     } else {
       warn "  ($record unlinked)" if $DEBUG > 1;
       $seen_unlinked++ ? '' : '(unlinked)';
@@ -479,6 +485,20 @@ sub cust_aligns {
   }
 }
 
+=item is_mobile
+
+Utility function to determine if the client is a mobile browser.
+
+=cut
+
+sub is_mobile {
+  my $ua = $ENV{'HTTP_USER_AGENT'} || '';
+  if ( $ua =~ /(?:hiptop|Blazer|Novarra|Vagabond|SonyEricsson|Symbian|NetFront|UP.Browser|UP.Link|Windows CE|MIDP|J2ME|DoCoMo|J-PHONE|PalmOS|PalmSource|iPhone|iPod|AvantGo|Nokia|Android|WebOS|S60|Opera Mini|Opera Mobi)/io ) {
+    return 1;
+  }
+  return 0;
+}
+    
 ###
 # begin JSRPC code...
 ###
@@ -494,6 +514,7 @@ use JSON;
 use FS::UID qw(getotaker);
 use FS::Record qw(qsearchs);
 use FS::queue;
+use FS::CGI qw(rooturl);
 
 $DEBUG = 0;
 
@@ -565,6 +586,7 @@ sub start_job {
     }
   }
   $param{CurrentUser} = getotaker();
+  $param{RootURL} = rooturl($self->{cgi}->self_url);
   warn "FS::UI::Web::start_job\n".
        join('', map {
                       if ( ref($param{$_}) ) {
@@ -620,19 +642,23 @@ sub job_status {
   }
 
   my @return;
-  if ( $job && $job->status ne 'failed' ) {
+  if ( $job && $job->status ne 'failed' && $job->status ne 'done' ) {
     my ($progress, $action) = split ',', $job->statustext, 2; 
     $action ||= 'Server processing job';
     @return = ( 'progress', $progress, $action );
   } elsif ( !$job ) { #handle job gone case : job successful
                       # so close popup, redirect parent window...
     @return = ( 'complete' );
+  } elsif ( $job->status eq 'done' ) {
+    @return = ( 'done', $job->statustext, '' );
   } else {
     @return = ( 'error', $job ? $job->statustext : $jobnum );
   }
 
   #to_json(\@return);  #waiting on deb 5.0 for new JSON.pm?
-  objToJson(\@return);
+  #silence the warning though
+  my $to_json = JSON->can('to_json') || JSON->can('objToJson');
+  &$to_json(\@return);
 
 }