Pimcore Perspective Editor vulnerable to Cross-site Scripting in perspective name

An attacker with the ability to create or rename perspectives/views (typically an admin user) can inject malicious JavaScript into the name field. When the name is later rendered in the Pimcore admin interface without proper sanitization, the injected script executes in the context of another administrator's session. This can lead to cookie theft (session hijacking) or redirection to attacker-controlled sites. The attack requires the victim to view the crafted perspective or view name in the admin UI [patch_id=1640890].

The vulnerability exists in the JavaScript files `src/Resources/public/js/pimcore/perspective/perspective.js` and `src/Resources/public/js/pimcore/perspective/view.js`, where user-supplied names for perspectives and views are not sanitized before being stored. Additionally, the server-side PHP files `src/Services/ViewAccessor.php` and `src/Services/PerspectiveAccessor.php` lacked output encoding when persisting these names to configuration, allowing stored XSS to propagate.

The patch adds a `sanitizeName()` method to both `perspective.js` and `view.js` that strips any characters outside `[a-z0-9_\-\.+]` from user input before it is used. On the server side, `htmlspecialchars()` is applied to the name in `PerspectiveAccessor.php` and `ViewAccessor.php` when converting the tree store to configuration. This two-layer defense ensures that even if client-side sanitization is bypassed, stored names are safely HTML-encoded before being rendered, preventing XSS [patch_id=1640890].