lucaspalomodevelop/core
1
0
Fork 0
mirror of https://github.com/lucaspalomodevelop/core.git synced 2026-03-15 09:04:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

(mvc) optionally disable output cleansing on API calls

Browse Source
This commit is contained in:
Ad Schellevis 2015-08-28 15:40:25 +02:00
parent f326e38c6b
commit 39100ebc43
1 changed files with 21 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
src/opnsense/mvc/app/controllers/OPNsense/Base/ApiControllerBase.php
View File

@ -34,6 +34,21 @@ namespace OPNsense\Base;
*/
class ApiControllerBase extends ControllerRoot
{
/**
* @var bool cleanse output before sending to client, be very careful to disable this (XSS).
*/
private $cleanseOutput = true;
/**
* disable output cleansing.
* Prevents the framework from executing automatic XSS protection on all delivered json data.
* Be very careful to disable this, if content can't be guaranteed you might introduce XSS vulnerabilities.
*/
protected function disableOutputCleansing()
{
$this->cleanseOutput = false;
}
/**
* Initialize API controller
*/
@ -90,7 +105,12 @@ class ApiControllerBase extends ControllerRoot
$data = $dispatcher->getReturnedValue();
if (is_array($data)) {
$this->response->setContentType('application/json', 'UTF-8');
echo htmlspecialchars(json_encode($data), ENT_NOQUOTES);
if ($this->cleanseOutput) {
echo htmlspecialchars(json_encode($data), ENT_NOQUOTES);
} else {
echo json_encode($data);
}
}
}