From 40621823dc58521d07c0f482ecb5f97dd2fd3782 Mon Sep 17 00:00:00 2001
From: Hillel Coren <hillelcoren@gmail.com>
Date: Wed, 17 Apr 2019 18:29:09 +0300
Subject: [PATCH] XSS fixes

---
 app/Libraries/Utils.php                    | 1 +
 app/Ninja/Datatables/ActivityDatatable.php | 2 +-
 app/Ninja/Presenters/ClientPresenter.php   | 5 +++--
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/app/Libraries/Utils.php b/app/Libraries/Utils.php
index 46511e42a86f..9ec8f7ae78d5 100644
--- a/app/Libraries/Utils.php
+++ b/app/Libraries/Utils.php
@@ -1199,6 +1199,7 @@ class Utils
             return '';
         }
 
+        $link = e($link);
         $title = $link;
         if (substr($link, 0, 4) != 'http') {
             $link = 'http://' . $link;
diff --git a/app/Ninja/Datatables/ActivityDatatable.php b/app/Ninja/Datatables/ActivityDatatable.php
index d601b81cbc14..bbfc7ca53234 100644
--- a/app/Ninja/Datatables/ActivityDatatable.php
+++ b/app/Ninja/Datatables/ActivityDatatable.php
@@ -45,7 +45,7 @@ class ActivityDatatable extends EntityDatatable
                         'invoice' => $model->invoice ? link_to('/invoices/' . $model->invoice_public_id, $model->is_recurring ? trans('texts.recurring_invoice') : $model->invoice)->toHtml() : null,
                         'quote' => $model->invoice ? link_to('/quotes/' . $model->invoice_public_id, $model->invoice)->toHtml() : null,
                         'contact' => $model->contact_id ? link_to('/clients/' . $model->client_public_id, Utils::getClientDisplayName($model))->toHtml() : Utils::getPersonDisplayName($model->user_first_name, $model->user_last_name, $model->user_email),
-                        'payment' => $model->payment ?: '',
+                        'payment' => $model->payment ? e($model->payment) : '',
                         'credit' => $model->payment_amount ? Utils::formatMoney($model->credit, $model->currency_id, $model->country_id) : '',
                         'payment_amount' => $model->payment_amount ? Utils::formatMoney($model->payment_amount, $model->currency_id, $model->country_id) : null,
                         'adjustment' => $model->adjustment ? Utils::formatMoney($model->adjustment, $model->currency_id, $model->country_id) : null,
diff --git a/app/Ninja/Presenters/ClientPresenter.php b/app/Ninja/Presenters/ClientPresenter.php
index 5ed162b51072..5561ca9cbaa0 100644
--- a/app/Ninja/Presenters/ClientPresenter.php
+++ b/app/Ninja/Presenters/ClientPresenter.php
@@ -32,9 +32,10 @@ class ClientPresenter extends EntityPresenter
             return '';
         }
 
-        $link = Utils::addHttp($client->website);
+        $website = e($client->website);
+        $link = Utils::addHttp($website);
 
-        return link_to($link, $client->website, ['target' => '_blank']);
+        return link_to($link, $website, ['target' => '_blank']);
     }
 
     public function paid_to_date()