{% extends "dashboard_layout.html" %}
{% block content %}
<div class="sql-injection">
    <div class="text-center" style="margin-top: 5%; margin-bottom: 5%">
        <h1>XML External Entities</h1>
    </div>
    <div class="mt-3 container text-center">
        <form id="showName">
            <div style="margin-left: 35%">
                <div class="mb-3 row">
                    <label for="name" class="col-auto col-form-label">Enter Your Name</label>
                    <div class="col-auto">
                        <input type="text" class="form-control" id="name" name="name">
                    </div>
                </div>
            </div>
            <input type="button" class='btn btn-fill btn-success btn-wd' value="Submit"
                   onclick="showName()"/>
        </form>
        <h6 class="text-center text-muted mt-3 msg"></h6>
    </div>
</div>

<script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/1.5.0/jquery.min.js"></script>
<script type="text/javascript">
    function showName() {
        let name = $("#name").val()

        let data = "<user><name>" + name + "</name></user>";

        {% if level == 1 or level == 2 %}
            data = window.btoa(data)
        {% endif %}

        $.ajax({
            type: "POST",
            url: "xxe",
            contentType: "application/xml; charset=utf-8",
            data: data,
            dataType: "xml",
            async: false,
            success: function (result) {
                console.log(result);
                result = result.getElementsByTagName("result")[0].getElementsByTagName("msg");
                let msg = result[0].childNodes[0].nodeValue;
                $(".msg").text(msg);
            }
        })
    }
</script>
{% endblock %}