Fixed issues reported by cure53.de

Fixed issues CLP-01-014 and CLP-01-015

1 files changed, 15 insertions, 7 deletions

diff --git a/frontend/beta/js/Clipperz/PM/DataModel/DirectLogin.js b/frontend/beta/js/Clipperz/PM/DataModel/DirectLogin.js
index c0cfa3c..56d9d59 100644
--- a/frontend/beta/js/Clipperz/PM/DataModel/DirectLogin.js
+++ b/frontend/beta/js/Clipperz/PM/DataModel/DirectLogin.js
@@ -39,5 +39,5 @@ Clipperz.PM.DataModel.DirectLogin = function(args) {
         this._label = args.label || "unnamed record"
         this._reference = args.reference || Clipperz.PM.Crypto.randomKey();
-        this._favicon = args.favicon || null;
+        this._favicon = Clipperz.Base.sanitizeFavicon(args.favicon) || null;
         this._bookmarkletVersion = args.bookmarkletVersion || "0.1";
 
@@ -103,7 +103,7 @@ Clipperz.PM.DataModel.DirectLogin.prototype = MochiKit.Base.update(null, {
                         var hostname;
                         
-                        actionUrl = this.formData()['attributes']['action'];
+                        actionUrl = this.action();
                         hostname = actionUrl.replace(/^https?:\/\/([^\/]*)\/.*/, '$1');
-                        this._favicon = "http://" + hostname + "/favicon.ico";
+                        this._favicon = Clipperz.Base.sanitizeFavicon("http://" + hostname + "/favicon.ico");
                 }
 
@@ -138,4 +138,12 @@ Clipperz.PM.DataModel.DirectLogin.prototype = MochiKit.Base.update(null, {
         },
         
+        'action': function () {
+                        varresult;
+                
+                result = Clipperz.Base.sanitizeUrl(this.formData()['attributes']['action']);
+                
+                return result;
+        },
+        
         //-------------------------------------------------------------------------
 
@@ -443,5 +451,5 @@ Clipperz.PM.DataModel.DirectLogin.prototype = MochiKit.Base.update(null, {
 //console.log(this.formData()['attributes']);
                                 formElement = MochiKit.DOM.FORM(MochiKit.Base.update({id:'directLoginForm'}, {'method':this.formData()['attributes']['method'],
-                                                                                                                                                                                        'action':this.formData()['attributes']['action']}));
+                                                                                                                                                                                        'action': this.action()}));
 //MochiKit.Logging.logDebug("### runDirectLogin - 5");
                         formSubmitFunction = MochiKit.Base.method(formElement, 'submit');
@@ -488,7 +496,7 @@ Clipperz.PM.DataModel.DirectLogin.prototype = MochiKit.Base.update(null, {
 //console.log("formData.attributes", this.formData()['attributes']);
         //      if (/^javascript/.test(this.formData()['attributes']['action'])) {
-                if ((/^(https?|webdav|ftp)\:/.test(this.formData()['attributes']['action']) == false) &&
-                        (this.formData()['attributes']['type'] != 'http_auth'))
-                {
+                if ((/^(https?|webdav|ftp)\:/.test(this.action()) == false) &&
+                        (this.formData()['attributes']['type'] != 'http_auth')
+                ) {
                         var messageBoxConfiguration;