CVE-2022-2796: [Admin] Translations - properly escape key on roweditor · pimcore/pimcore@2fd4685

@@ -247,7 +247,10 @@ pimcore.settings.translation.domain = Class.create({

];

var typesColumns = [

{text: t(“key”), sortable: true, dataIndex: 'key’, flex: 1, editable: false, filter: 'string’},

{text: t(“key”), sortable: true, dataIndex: 'key’, flex: 1, editable: false, filter: 'string’,

editor: new Ext.form.DisplayField({

htmlEncode: true

})},

{text: t(“type”), sortable: true, dataIndex: 'type’, width: 100, editor: new Ext.form.ComboBox({

triggerAction: 'all’,

editable: false,

@@ -315,7 +318,7 @@ pimcore.settings.translation.domain = Class.create({

icon: "/bundles/pimcoreadmin/img/flat-color-icons/delete.svg",

handler: function (grid, rowIndex) {

let data = grid.getStore().getAt(rowIndex);

pimcore.helpers.deleteConfirm(t(‘translation’), data.data.key, function () {

pimcore.helpers.deleteConfirm(t(‘translation’), Ext.util.Format.htmlEncode(data.data.key), function () {

grid.getStore().removeAt(rowIndex);

}.bind(this));

}.bind(this)