Changeset 851 for trunk/Modules/Team/Team.php

Timestamp:

Jan 17, 2016, 10:07:13 PM (8 years ago)

Author:

chronos

Message:

• Fixed: Use htmlspecialchars function for user inserted content to avoid breaking page HTML structure. Added for forum, teams, dictionary and profile text.

File:

• trunk/Modules/Team/Team.php (modified) (5 diffs)

trunk/Modules/Team/Team.php

@@ -47 +47 @@
     {
       $SearchQuery = ' AND ((`Name` LIKE "%'.$_SESSION['search'].'%") OR (`Description` LIKE "%'.$_SESSION['search'].'%"))';
-      $Output .= '<div><a href="?search=">'.sprintf(T('Disable filter "%s"'), $_SESSION['search']).'</a></div>';
+      $Output .= '<div><a href="?search=">'.sprintf(T('Disable filter "%s"'), htmlspecialchars($_SESSION['search'])).'</a></div>';
     } else $SearchQuery = '';
 
@@ -75 +75 @@
     {
       $Output .= '<tr>'.
-        '<td><a href="?action=team&amp;id='.$Team['Id'].'">'.$Team['Name'].'</a></td>'.
-        '<td><a href="http://'.$Team['URL'].'">'.$Team['URL'].'</a></td>'.
+        '<td><a href="?action=team&amp;id='.$Team['Id'].'">'.htmlspecialchars($Team['Name']).'</a></td>'.
+        '<td><a href="http://'.$Team['URL'].'">'.htmlspecialchars($Team['URL']).'</a></td>'.
         '<td><a href="'.$this->System->Link('/user/?user='.$Team['Leader']).'">'.$Team['LeaderName'].'</a></td>'.
         '<td><a href="'.$this->System->Link('/users/?team='.$Team['Id']).'" title="Zobrazit členy týmu">'.$Team['NumberUser'].'</a></td>'.
@@ -157 +157 @@
           $Output = '<form action="?action=finish_modify&amp;id='.$_GET['id'].'" method="post">'.
             '<fieldset><legend>Nastavení týmu</legend>'.
-            '<table><tr><td>Jméno:</td><td><input type="text" name="Name" value="'.$Team['Name'].'"/></td></tr>'.
-            '<tr><td>Webové stránky:</td><td>http://<input type="text" name="URL" value="'.$Team['URL'].'"/></td></tr>'.
-            '<tr><td>Popis:</td><td><input type="text" name="Description" value="'.$Team['Description'].'"/></td></tr>'.
-            '<tr><td colspan="2"><input type="submit" value="Uložit" /></td></tr>'.
+            '<table><tr><td>Jméno:</td><td><input type="text" name="Name" value="'.htmlspecialchars($Team['Name']).'"/></td></tr>'.
+            '<tr><td>Webové stránky:</td><td>http://<input type="text" name="URL" value="'.htmlspecialchars($Team['URL']).'"/></td></tr>'.
+            '<tr><td>Popis:</td><td><input type="text" name="Description" value="'.htmlspecialchars($Team['Description']).'"/></td></tr>'.
+            '<tr><td colspan="2"><input type="submit" value="'.T('Save').'" /></td></tr>'.
             '</table></fieldset></form>';
         } else $Output = ShowMesage('Tým nenalezen.', MESSAGE_CRITICAL);
@@ -230 +230 @@
         } else $Leader = array('Name' => '', 'Id' => 0);
 
-        $Output .='<h3>'.T('Translation team').' '.$Team['Name'].'</h3><br />'.
-          T('Web pages').': <a href="http://'.$Team['URL'].'">'.$Team['URL'].'</a><br/>'.
+        $Output .='<h3>'.T('Translation team').' '.htmlspecialchars($Team['Name']).'</h3><br />'.
+          T('Web pages').': <a href="http://'.htmlspecialchars($Team['URL']).'">'.htmlspecialchars($Team['URL']).'</a><br/>'.
           T('Leader').': <a href="'.$this->System->Link('/user/?user='.$Leader['Id']).'">'.$Leader['Name'].'</a><br/>';
         if($Team['Description'] != '')
-          $Output .= T('Description').': '.$Team['Description'].'<br />';
+          $Output .= T('Description').': '.htmlspecialchars($Team['Description']).'<br />';
         $Output .= '<br />';
         //$Output .= '<a href="export/?team='.$Team['Id'].'">Exportovat překlad týmu</a> ';
@@ -241 +241 @@
         $XP = GetLevelMinMax($Team['AverageXP']);
         $Output .='<fieldset><legend>'.T('Statistics').'</legend>'.
-          T('Team member count').': <a href="'.$this->System->Link('/userlist/?team='.$Team['Id']).'" title="Zobrazit členy týmu">'.$Team['NumberUser'].'</a><br />'.
+          T('Team member count').': <a href="'.$this->System->Link('/users/?team='.$Team['Id']).'" title="Zobrazit členy týmu">'.$Team['NumberUser'].'</a><br />'.
           T('Team number of translated texts').': <strong>'.$Team['NumberTranslate'].'</strong><br />'.
           T('Average level of team members').': <strong>'.$XP['Level'].'</strong> '.T('experience').': '.ProgressBar(150, round($XP['XP'] / $XP['MaxXP'] * 100, 2), $XP['XP'].' / '.$XP['MaxXP']).'<br />'.