Merge pull request #3763 from overleaf/jpa-xss-7

[views] mitigate XSS on new subscription page GitOrigin-RevId: 74baa58527aa9b2f9e434c280885b627f73898b6
2021-03-13 03:05:14 +00:00
parent d9576189a3
commit 18eea6d024
3 changed files with 16 additions and 18 deletions
@@ -121,21 +121,17 @@ module.exports = SubscriptionController = {
                  }
                  return res.render('subscriptions/new', {
                    title: 'subscribe',
-                    plan_code: req.query.planCode,
                    currency,
                    countryCode,
                    plan,
-                    showStudentPlan: req.query.ssp,
+                    showStudentPlan: req.query.ssp === 'true',
                    recurlyConfig: JSON.stringify({
                      currency,
                      subdomain: Settings.apis.recurly.subdomain
                    }),
-                    showCouponField: req.query.scf,
-                    showVatField: req.query.svf,
-                    couponCode: req.query.cc || '',
-                    gaOptimize: true,
-                    ITMCampaign: req.query.itm_campaign,
-                    ITMContent: req.query.itm_content
+                    showCouponField: !!req.query.scf,
+                    showVatField: !!req.query.svf,
+                    gaOptimize: true
                  })
                }
              )