From a6fb23302e8a84f93178b25f065e30c3d2106fbc Mon Sep 17 00:00:00 2001
From: Eymen Elkum <aymanalkom@gmail.com>
Date: Sat, 24 Apr 2021 16:59:32 +0300
Subject: [PATCH 1/2] typo fix (#1974)

---
 application/Espo/Jobs/Cleanup.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/application/Espo/Jobs/Cleanup.php b/application/Espo/Jobs/Cleanup.php
index 92b3a6e80b..80d88b7664 100644
--- a/application/Espo/Jobs/Cleanup.php
+++ b/application/Espo/Jobs/Cleanup.php
@@ -63,7 +63,7 @@ class Cleanup implements Job
 
     protected $config;
     protected $entityManager;
-    protected $metedata;
+    protected $metadata;
     protected $fileManager;
     protected $injectableFactory;
     protected $selectManagerFactory;

From 1a672a8aa31631d466e36d098393172554d1da7d Mon Sep 17 00:00:00 2001
From: Yuri Kuznetsov <yurikuzn@users.noreply.github.com>
Date: Tue, 4 May 2021 16:08:35 +0300
Subject: [PATCH 2/2] escaping

---
 client/src/views/fields/attachment-multiple.js       |  7 +++++++
 client/src/views/fields/file.js                      |  6 ++++++
 .../src/views/fields/link-multiple-with-primary.js   |  5 ++++-
 client/src/views/fields/link-multiple-with-role.js   | 12 ++++++++++--
 client/src/views/fields/link-multiple.js             | 11 +++++++++--
 client/src/views/fields/link.js                      |  9 ++++++++-
 client/src/views/fields/user.js                      |  3 +++
 7 files changed, 47 insertions(+), 6 deletions(-)

diff --git a/client/src/views/fields/attachment-multiple.js b/client/src/views/fields/attachment-multiple.js
index 6cd01b4403..40dc3b543a 100644
--- a/client/src/views/fields/attachment-multiple.js
+++ b/client/src/views/fields/attachment-multiple.js
@@ -293,6 +293,8 @@ define('views/fields/attachment-multiple', 'views/fields/base', function (Dep) {
         },
 
         getDownloadUrl: function (id) {
+            id = Handlebars.Utils.escapeExpression(id);
+
             var url = this.getBasePath() + '?entryPoint=download&id=' + id;
 
             if (this.getUser().get('portalId')) {
@@ -354,6 +356,7 @@ define('views/fields/attachment-multiple', 'views/fields/base', function (Dep) {
 
         getEditPreview: function (name, type, id) {
             name = Handlebars.Utils.escapeExpression(name);
+            id = Handlebars.Utils.escapeExpression(id);
 
             var preview = name;
 
@@ -365,6 +368,8 @@ define('views/fields/attachment-multiple', 'views/fields/base', function (Dep) {
         },
 
         addAttachmentBox: function (name, type, id, link) {
+            id = Handlebars.Utils.escapeExpression(id);
+
             var $attachments = this.$attachments;
 
             var removeLink = '<a href="javascript:" class="remove-attachment pull-right">'+
@@ -609,6 +614,7 @@ define('views/fields/attachment-multiple', 'views/fields/base', function (Dep) {
 
         getDetailPreview: function (name, type, id) {
             name = Handlebars.Utils.escapeExpression(name);
+            id = Handlebars.Utils.escapeExpression(id);
 
             var preview = name;
 
@@ -648,6 +654,7 @@ define('views/fields/attachment-multiple', 'views/fields/base', function (Dep) {
 
                         continue;
                     }
+
                     var line = '<div class="attachment-block">' +
                         '<span class="fas fa-paperclip text-soft small"></span> ' +
                         '<a href="' + this.getDownloadUrl(id) + '" target="_BLANK">' +
diff --git a/client/src/views/fields/file.js b/client/src/views/fields/file.js
index a0b614a883..f418588048 100644
--- a/client/src/views/fields/file.js
+++ b/client/src/views/fields/file.js
@@ -308,6 +308,8 @@ define('views/fields/file', 'views/fields/link', function (Dep) {
                 }
             }
 
+            id = Handlebars.Utils.escapeExpression(id);
+
             var src = this.getBasePath() + '?entryPoint=image&size=' + previewSize + '&id=' + id;
 
             var img = '<img src="' + src + '" class="image-preview">';
@@ -328,6 +330,8 @@ define('views/fields/file', 'views/fields/link', function (Dep) {
 
         getEditPreview: function (name, type, id) {
             name = Handlebars.Utils.escapeExpression(name);
+            id = Handlebars.Utils.escapeExpression(id);
+
             var preview = name;
 
             if (~this.previewTypeList.indexOf(type)) {
@@ -369,6 +373,8 @@ define('views/fields/file', 'views/fields/link', function (Dep) {
         },
 
         getImageUrl: function (id, size) {
+            id = Handlebars.Utils.escapeExpression(id);
+
             var url = this.getBasePath() + '?entryPoint=image&id=' + id;
 
             if (size) {
diff --git a/client/src/views/fields/link-multiple-with-primary.js b/client/src/views/fields/link-multiple-with-primary.js
index e5c5f7045e..ec12341053 100644
--- a/client/src/views/fields/link-multiple-with-primary.js
+++ b/client/src/views/fields/link-multiple-with-primary.js
@@ -125,6 +125,9 @@ Espo.define('views/fields/link-multiple-with-primary', 'views/fields/link-multip
         addLinkHtml: function (id, name) {
             name = name || id;
 
+            id = Handlebars.Utils.escapeExpression(id);
+            name = Handlebars.Utils.escapeExpression(name);
+
             if (this.mode == 'search') {
                 return Dep.prototype.addLinkHtml.call(this, id, name);
             }
@@ -132,7 +135,7 @@ Espo.define('views/fields/link-multiple-with-primary', 'views/fields/link-multip
             var $container = this.$el.find('.link-container');
             var $el = $('<div class="form-inline list-group-item link-with-role clearfix link-group-item-with-primary">').addClass('link-' + id).attr('data-id', id);
 
-            var nameHtml = '<div>' + this.getHelper().escapeString(name) || id + '&nbsp;' + '</div>';
+            var nameHtml = '<div>' + name + '&nbsp;' + '</div>';
             var removeHtml = '<a href="javascript:" class="pull-right" data-id="' + id + '" data-action="clearLink"><span class="fas fa-times"></a>';
 
             $left = $('<div>');
diff --git a/client/src/views/fields/link-multiple-with-role.js b/client/src/views/fields/link-multiple-with-role.js
index 09d287888e..0e2b88ce5d 100644
--- a/client/src/views/fields/link-multiple-with-role.js
+++ b/client/src/views/fields/link-multiple-with-role.js
@@ -79,6 +79,9 @@ define('views/fields/link-multiple-with-role', 'views/fields/link-multiple', fun
                 name = this.translate(this.foreignScope, 'scopeNames');
             }
 
+            id = Handlebars.Utils.escapeExpression(id);
+            name = Handlebars.Utils.escapeExpression(name);
+
             var role = (this.columns[id] || {})[this.columnName] || '';
             var roleHtml = '';
 
@@ -107,7 +110,7 @@ define('views/fields/link-multiple-with-role', 'views/fields/link-multiple', fun
             if (this.mode == 'detail') {
                 iconHtml = this.getIconHtml(id);
             }
-            var lineHtml = '<div>' + iconHtml + '<a href="#' + this.foreignScope + '/view/' + id + '">' + this.getHelper().escapeString(name) + '</a> ' + roleHtml + '</div>';
+            var lineHtml = '<div>' + iconHtml + '<a href="#' + this.foreignScope + '/view/' + id + '">' + name + '</a> ' + roleHtml + '</div>';
             return lineHtml;
         },
 
@@ -161,6 +164,8 @@ define('views/fields/link-multiple-with-role', 'views/fields/link-multiple', fun
         },
 
         getJQSelect: function (id, roleValue) {
+            id = Handlebars.Utils.escapeExpression(id);
+
             var $role = $('<select class="role form-control input-sm pull-right" data-id="'+id+'">');
             this.roleList.forEach(function (role) {
                 var selectedHtml = (role == roleValue) ? 'selected': '';
@@ -178,10 +183,13 @@ define('views/fields/link-multiple-with-role', 'views/fields/link-multiple', fun
                 return Dep.prototype.addLinkHtml.call(this, id, name);
             }
 
+            id = Handlebars.Utils.escapeExpression(id);
+            name = Handlebars.Utils.escapeExpression(name);
+
             var $container = this.$el.find('.link-container');
             var $el = $('<div class="form-inline list-group-item link-with-role link-group-item-with-columns clearfix">').addClass('link-' + id);
 
-            var nameHtml = '<div>' + this.getHelper().escapeString(name) + '&nbsp;' + '</div>';
+            var nameHtml = '<div>' + name + '&nbsp;' + '</div>';
 
             var removeHtml = '<a href="javascript:" class="pull-right" data-id="' + id + '" data-action="clearLink"><span class="fas fa-times"></a>';
 
diff --git a/client/src/views/fields/link-multiple.js b/client/src/views/fields/link-multiple.js
index f4a7cd8447..f65b214cd6 100644
--- a/client/src/views/fields/link-multiple.js
+++ b/client/src/views/fields/link-multiple.js
@@ -328,9 +328,12 @@ define('views/fields/link-multiple', 'views/fields/base', function (Dep) {
         addLinkHtml: function (id, name) {
             name = name || id;
 
+            id = Handlebars.Utils.escapeExpression(id);
+            name = Handlebars.Utils.escapeExpression(name);
+
             var $container = this.$el.find('.link-container');
             var $el = $('<div />').addClass('link-' + id).addClass('list-group-item').attr('data-id', id);
-            $el.html(this.getHelper().escapeString(name || id) + '&nbsp');
+            $el.html(name + '&nbsp');
             $el.prepend('<a href="javascript:" class="pull-right" data-id="' + id + '" data-action="clearLink"><span class="fas fa-times"></a>');
             $container.append($el);
 
@@ -343,6 +346,10 @@ define('views/fields/link-multiple', 'views/fields/base', function (Dep) {
 
         getDetailLinkHtml: function (id) {
             var name = this.nameHash[id] || id;
+
+            id = Handlebars.Utils.escapeExpression(id);
+            name = Handlebars.Utils.escapeExpression(name);
+
             if (!name && id) {
                 name = this.translate(this.foreignScope, 'scopeNames');
             }
@@ -350,7 +357,7 @@ define('views/fields/link-multiple', 'views/fields/base', function (Dep) {
             if (this.mode == 'detail') {
                 iconHtml = this.getIconHtml(id);
             }
-            return '<a href="#' + this.foreignScope + '/view/' + id + '">' + iconHtml + this.getHelper().escapeString(name) + '</a>';
+            return '<a href="#' + this.foreignScope + '/view/' + id + '">' + iconHtml + name + '</a>';
         },
 
         getValueForDisplay: function () {
diff --git a/client/src/views/fields/link.js b/client/src/views/fields/link.js
index fb41dc51f6..880f8a6d4e 100644
--- a/client/src/views/fields/link.js
+++ b/client/src/views/fields/link.js
@@ -421,10 +421,17 @@ define('views/fields/link', 'views/fields/base', function (Dep) {
         },
 
         addLinkOneOfHtml: function (id, name) {
+            id = Handlebars.Utils.escapeExpression(id);
+            name = this.getHelper().escapeString(name);
+
             var $container = this.$el.find('.link-one-of-container');
+
             var $el = $('<div />').addClass('link-' + id).addClass('list-group-item');
-            $el.html(this.getHelper().escapeString(name) + '&nbsp');
+
+            $el.html(name + '&nbsp');
+
             $el.prepend('<a href="javascript:" class="pull-right" data-id="' + id + '" data-action="clearLinkOneOf"><span class="fas fa-times"></a>');
+
             $container.append($el);
 
             return $el;
diff --git a/client/src/views/fields/user.js b/client/src/views/fields/user.js
index f4117de19f..66dcd9a3c6 100644
--- a/client/src/views/fields/user.js
+++ b/client/src/views/fields/user.js
@@ -167,6 +167,9 @@ Espo.define('views/fields/user', 'views/fields/link', function (Dep) {
         },
 
         addLinkTeamsHtml: function (id, name) {
+            id = Handlebars.Utils.escapeExpression(id);
+            name = Handlebars.Utils.escapeExpression(name);
+
             var $container = this.$el.find('.link-teams-container');
             var $el = $('<div />').addClass('link-' + id).addClass('list-group-item');
             $el.html(name + '&nbsp');