Fixes minor vulnerability when using target="_blank" on links (RSPEC-5148)

[bookstack] / app / Http / Controllers / PageController.php

diff --git a/app/Http/Controllers/PageController.php b/app/Http/Controllers/PageController.php
index 7d8e54382961006db647b5f1b1b4fe9982337a2d..134c22081382bdd0a3a407b469bd7684ccb9c4d0 100644 (file)
--- a/app/Http/Controllers/PageController.php
+++ b/app/Http/Controllers/PageController.php
@@ -1,5 +1,6 @@
 <?php namespace BookStack\Http\Controllers;
 
 <?php namespace BookStack\Http\Controllers;
 

+use BookStack\Actions\View;

 use BookStack\Entities\Tools\BookContents;
 use BookStack\Entities\Tools\PageContent;
 use BookStack\Entities\Tools\PageEditActivity;
 use BookStack\Entities\Tools\BookContents;
 use BookStack\Entities\Tools\PageContent;
 use BookStack\Entities\Tools\PageEditActivity;


@@ -7,7 +8,6 @@ use BookStack\Entities\Models\Page;
 use BookStack\Entities\Repos\PageRepo;
 use BookStack\Entities\Tools\PermissionsUpdater;
 use BookStack\Exceptions\NotFoundException;
 use BookStack\Entities\Repos\PageRepo;
 use BookStack\Entities\Tools\PermissionsUpdater;
 use BookStack\Exceptions\NotFoundException;

-use BookStack\Exceptions\NotifyException;

 use BookStack\Exceptions\PermissionsException;
 use Exception;
 use Illuminate\Http\Request;
 use BookStack\Exceptions\PermissionsException;
 use Exception;
 use Illuminate\Http\Request;


@@ -142,7 +142,7 @@ class PageController extends Controller
             $page->load(['comments.createdBy']);
         }
 
             $page->load(['comments.createdBy']);
         }
 

-        Views::add($page);
+        View::incrementFor($page);

         $this->setPageTitle($page->getShortName());
         return view('pages.show', [
             'page' => $page,
         $this->setPageTitle($page->getShortName());
         return view('pages.show', [
             'page' => $page,


@@ -295,7 +295,6 @@ class PageController extends Controller
      * Remove the specified page from storage.
      * @throws NotFoundException
      * @throws Throwable
      * Remove the specified page from storage.
      * @throws NotFoundException
      * @throws Throwable

-     * @throws NotifyException

      */
     public function destroy(string $bookSlug, string $pageSlug)
     {
      */
     public function destroy(string $bookSlug, string $pageSlug)
     {


@@ -311,7 +310,6 @@ class PageController extends Controller
     /**
      * Remove the specified draft page from storage.
      * @throws NotFoundException
     /**
      * Remove the specified draft page from storage.
      * @throws NotFoundException

-     * @throws NotifyException

      * @throws Throwable
      */
     public function destroyDraft(string $bookSlug, int $pageId)
      * @throws Throwable
      */
     public function destroyDraft(string $bookSlug, int $pageId)


@@ -340,9 +338,9 @@ class PageController extends Controller
             ->paginate(20)
             ->setPath(url('/pages/recently-updated'));
 
             ->paginate(20)
             ->setPath(url('/pages/recently-updated'));
 

-        return view('pages.detailed-listing', [
+        return view('common.detailed-listing-paginated', [

             'title' => trans('entities.recently_updated_pages'),
             'title' => trans('entities.recently_updated_pages'),

-            'pages' => $pages
+            'entities' => $pages

         ]);
     }
 
         ]);
     }