diff --git a/Controls/DatePickerSetupControl.php b/Controls/DatePickerSetupControl.php index 8a50a7901..1c5f40873 100644 --- a/Controls/DatePickerSetupControl.php +++ b/Controls/DatePickerSetupControl.php @@ -82,6 +82,13 @@ public function PageLoad() $this->Set('DefaultDate', $defaultDate->Format('Y-m-d')); } + $encodedDefaultDate = 'null'; + $defaultDateForJs = $this->Get('DefaultDate'); + if (!empty($defaultDateForJs)) { + $encodedDefaultDate = $this->JsonEncodeForInlineScript($defaultDateForJs); + } + $this->Set('DefaultDateJson', $encodedDefaultDate); + $this->SetDefault('MinDate', null); $this->SetDefault('MaxDate', null); @@ -92,6 +99,20 @@ public function PageLoad() } } + /** + * Encodes values as JSON for safe embedding inside inline ), reducing XSS risk. + */ + private function JsonEncodeForInlineScript(mixed $value): string + { + $json = json_encode( + $value, + JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT + ); + return $json === false ? 'null' : $json; + } + private function SetDefault($key, $value) { $item = $this->Get($key); diff --git a/tpl/Controls/Attributes/Date.tpl b/tpl/Controls/Attributes/Date.tpl index 250872349..558749564 100644 --- a/tpl/Controls/Attributes/Date.tpl +++ b/tpl/Controls/Attributes/Date.tpl @@ -1,17 +1,14 @@
{assign value="{$attribute->Value()}" var="attributeValue"} - {if $readonly} {formatdate date=$attributeValue key=general_datetime} {else} - - - {control type="DatePickerSetupControl" ControlId="{$attributeId}" AltId="formatted{$attributeId}" - HasTimepicker=true} + {control type="DatePickerSetupControl" ControlId="{$attributeId}" DefaultDate=$attributeValue HasTimepicker=true} {/if} -
\ No newline at end of file + diff --git a/tpl/Controls/DatePickerSetup.tpl b/tpl/Controls/DatePickerSetup.tpl index eb35cc152..51e1c412f 100644 --- a/tpl/Controls/DatePickerSetup.tpl +++ b/tpl/Controls/DatePickerSetup.tpl @@ -28,16 +28,7 @@ altInput: {if $AltInput|default:true}true{else}false{/if}, altFormat: "{$AltFormat}", dateFormat: "{$DateFormat}", - defaultDate: - {if $DefaultDate} - {if $Multiple} - {$DefaultDate|json_encode} - {else} - "{$DefaultDate}" - {/if} - {else} - null - {/if}, + defaultDate: {$DefaultDateJson nofilter}, minDate: {if $MinDate}"{$MinDate}"{else}null{/if}, maxDate: {if $MaxDate}"{$MaxDate}"{else}null{/if}, enableTime: {$HasTimepicker ? 'true' : 'false'},