diff --git a/Controls/DatePickerSetupControl.php b/Controls/DatePickerSetupControl.php index 8a50a7901..1c5f40873 100644 --- a/Controls/DatePickerSetupControl.php +++ b/Controls/DatePickerSetupControl.php @@ -82,6 +82,13 @@ public function PageLoad() $this->Set('DefaultDate', $defaultDate->Format('Y-m-d')); } + $encodedDefaultDate = 'null'; + $defaultDateForJs = $this->Get('DefaultDate'); + if (!empty($defaultDateForJs)) { + $encodedDefaultDate = $this->JsonEncodeForInlineScript($defaultDateForJs); + } + $this->Set('DefaultDateJson', $encodedDefaultDate); + $this->SetDefault('MinDate', null); $this->SetDefault('MaxDate', null); @@ -92,6 +99,20 @@ public function PageLoad() } } + /** + * Encodes values as JSON for safe embedding inside inline ), reducing XSS risk. + */ + private function JsonEncodeForInlineScript(mixed $value): string + { + $json = json_encode( + $value, + JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT + ); + return $json === false ? 'null' : $json; + } + private function SetDefault($key, $value) { $item = $this->Get($key); diff --git a/tpl/Controls/Attributes/Date.tpl b/tpl/Controls/Attributes/Date.tpl index 250872349..558749564 100644 --- a/tpl/Controls/Attributes/Date.tpl +++ b/tpl/Controls/Attributes/Date.tpl @@ -1,17 +1,14 @@