Headline
CVE-2022-0928: upgrade taxes to laravel routers · microweber/microweber@fc9137c
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.12.
@@ -11,6 +11,9 @@
namespace MicroweberPackages\Tax;
use Illuminate\Support\Facades\Validator;
use MicroweberPackages\Helper\HTMLClean;
class TaxManager
{
/** @var \MicroweberPackages\App\LaravelApplication */
@@ -50,6 +53,18 @@ public function save($params = array())
$params[‘rate’] = floatval($params[‘rate’]);
}
$rules = [];
$rules[‘name’] = 'required|max:500’;
$rules[‘type’] = 'required|max:500’;
$rules[‘rate’] = 'required|max:500’;
$validator = Validator::make($params, $rules);
if ($validator->fails()) {
$errors = $validator->messages()->toArray();
return ['valid’=>false,’errors’=>$errors];
}
$taxType = TaxType::where('id’, $params[‘id’])->first();
if (!$taxType) {
$taxType = new TaxType();