#1061 Escape quotes from case list filters

TheHive-Project · Apr 6, 2020 · ed884dc · ed884dc
1 parent ebf883c
commit ed884dc
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 5 deletions.
diff --git a/ui/app/scripts/controllers/case/CaseListCtrl.js b/ui/app/scripts/controllers/case/CaseListCtrl.js
@@ -246,8 +246,8 @@
                   self.caseResponders = responders;
               })
               .catch(function(err) {
-                  NotificationSrv.error('CaseList', response.data, response.status);
-              })
+                  NotificationSrv.error('CaseList', err.data, err.status);
+              });
         };
 
         this.runResponder = function(responderId, responderName, caze) {

diff --git a/ui/app/scripts/services/CasesUISrv.js b/ui/app/scripts/services/CasesUISrv.js
@@ -165,10 +165,10 @@
 
                     // Prepare the filter value
                     if (field === 'keyword') {
-                        query = value;
+                        query = value.replace(/"/gi, '\\"');
                     } else if (angular.isArray(value) && value.length > 0) {
                         query = _.map(value, function(val) {
-                            return field + ':"' + convertFn(val.text) + '"';
+                            return field + ':"' + convertFn(val.text.replace(/"/gi, '\\"')) + '"';
                         }).join(' OR ');
                         query = '(' + query + ')';
                     } else if (filterDef.type === 'date') {
@@ -178,7 +178,7 @@
                         query = field + ':[ ' + fromDate + ' TO ' + toDate + ' ]';
 
                     } else {
-                        query = field + ':' + convertFn(value);
+                        query = field + ':' + convertFn(value.replace(/"/gi, '\\"'));
                     }
 
                     factory.filters[field] = {