[SECURITY-2557]

jenkinsci · Mar 9, 2022 · 543a4d8 · 543a4d8
1 parent 7019eb3
commit 543a4d8
Show file tree

Hide file tree

Showing 2 changed files with 30 additions and 4 deletions.
diff --git a/src/main/resources/hudson/plugins/favorite/column/FavoriteColumn/column.jelly b/src/main/resources/hudson/plugins/favorite/column/FavoriteColumn/column.jelly
@@ -6,9 +6,22 @@
     <j:set var="starClass" value="${it.getStarClassName(job.getFullName())}"/>
     <j:set var="sizeClass" value="${it.getSizeClassFromIconSize(subIconSize)}"/>
     <td data="${sortData}">
-      <a onclick="return toggleFavorite('${job.getFullName()}', this)" href="#">
-        <span id="fav_${job.getFullName()}" class="${starClass} ${sizeClass}"></span>
+      <a href="#">
+        <span id="fav_${job.getFullName()}" data-fullName="${job.getFullName()}"
+              class="${starClass} ${sizeClass}"/>
       </a>
+      <script>
+        (function() {
+          var currentScr = document.scripts[document.scripts.length - 1]; <!-- will always be row on which the current FavoriteColumn is added-->
+          var jobRow = currentScr.parentElement;
+          const favoriteLinkTag = jobRow.querySelector("a");
+          favoriteLinkTag.onclick = function(e) {
+            e.preventDefault();
+            const fullName = favoriteLinkTag.querySelector("span").getAttribute("data-fullName");
+            return toggleFavorite(fullName, this);
+          }
+        })()
+      </script>
     </td>
   </j:if>
 </j:jelly>
diff --git a/src/main/resources/hudson/plugins/favorite/user/FavoriteUserProperty/config.jelly b/src/main/resources/hudson/plugins/favorite/user/FavoriteUserProperty/config.jelly
@@ -7,9 +7,22 @@
       <j:forEach var="favorite" items="${instance.favorites}">
         <div id="favrow_${favorite}">
           <div>
-            <a onclick="return toggleFavorite('${favorite}', this)" href="#">
-              <span id="fav_${favorite}" class="icon-fav-active icon-sm"></span>
+            <a href="#">
+              <span id="fav_${favorite}" data-fullName="${favorite}"
+                    class="icon-fav-active icon-sm"/>
             </a>
+            <script>
+              (function() {
+                var currentScr = document.scripts[document.scripts.length - 1]; <!-- will always be row on which the current FavoriteColumn is added-->
+                var jobRow = currentScr.parentElement;
+                const favoriteLinkTag = jobRow.querySelector("a");
+                favoriteLinkTag.onclick = function(e) {
+                  e.preventDefault();
+                  const fullName = favoriteLinkTag.querySelector("span").getAttribute("data-fullName");
+                  return toggleFavorite(fullName, this);
+                }
+              })()
+            </script>
           </div>
           <div>
             <a href="${rootURL}/${descriptor.toItem(favorite).url}" >${favorite}</a>