Ignore:
Timestamp:
Jan 17, 2016, 10:07:13 PM (9 years ago)
Author:
chronos
Message:
  • Fixed: Use htmlspecialchars function for user inserted content to avoid breaking page HTML structure. Added for forum, teams, dictionary and profile text.
File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/Modules/Team/Team.php

    r849 r851  
    4747    {
    4848      $SearchQuery = ' AND ((`Name` LIKE "%'.$_SESSION['search'].'%") OR (`Description` LIKE "%'.$_SESSION['search'].'%"))';
    49       $Output .= '<div><a href="?search=">'.sprintf(T('Disable filter "%s"'), $_SESSION['search']).'</a></div>';
     49      $Output .= '<div><a href="?search=">'.sprintf(T('Disable filter "%s"'), htmlspecialchars($_SESSION['search'])).'</a></div>';
    5050    } else $SearchQuery = '';
    5151
     
    7575    {
    7676      $Output .= '<tr>'.
    77         '<td><a href="?action=team&amp;id='.$Team['Id'].'">'.$Team['Name'].'</a></td>'.
    78         '<td><a href="http://'.$Team['URL'].'">'.$Team['URL'].'</a></td>'.
     77        '<td><a href="?action=team&amp;id='.$Team['Id'].'">'.htmlspecialchars($Team['Name']).'</a></td>'.
     78        '<td><a href="http://'.$Team['URL'].'">'.htmlspecialchars($Team['URL']).'</a></td>'.
    7979        '<td><a href="'.$this->System->Link('/user/?user='.$Team['Leader']).'">'.$Team['LeaderName'].'</a></td>'.
    8080        '<td><a href="'.$this->System->Link('/users/?team='.$Team['Id']).'" title="Zobrazit členy týmu">'.$Team['NumberUser'].'</a></td>'.
     
    157157          $Output = '<form action="?action=finish_modify&amp;id='.$_GET['id'].'" method="post">'.
    158158            '<fieldset><legend>Nastavení týmu</legend>'.
    159             '<table><tr><td>Jméno:</td><td><input type="text" name="Name" value="'.$Team['Name'].'"/></td></tr>'.
    160             '<tr><td>Webové stránky:</td><td>http://<input type="text" name="URL" value="'.$Team['URL'].'"/></td></tr>'.
    161             '<tr><td>Popis:</td><td><input type="text" name="Description" value="'.$Team['Description'].'"/></td></tr>'.
    162             '<tr><td colspan="2"><input type="submit" value="Uložit" /></td></tr>'.
     159            '<table><tr><td>Jméno:</td><td><input type="text" name="Name" value="'.htmlspecialchars($Team['Name']).'"/></td></tr>'.
     160            '<tr><td>Webové stránky:</td><td>http://<input type="text" name="URL" value="'.htmlspecialchars($Team['URL']).'"/></td></tr>'.
     161            '<tr><td>Popis:</td><td><input type="text" name="Description" value="'.htmlspecialchars($Team['Description']).'"/></td></tr>'.
     162            '<tr><td colspan="2"><input type="submit" value="'.T('Save').'" /></td></tr>'.
    163163            '</table></fieldset></form>';
    164164        } else $Output = ShowMesage('Tým nenalezen.', MESSAGE_CRITICAL);
     
    230230        } else $Leader = array('Name' => '', 'Id' => 0);
    231231
    232         $Output .='<h3>'.T('Translation team').' '.$Team['Name'].'</h3><br />'.
    233           T('Web pages').': <a href="http://'.$Team['URL'].'">'.$Team['URL'].'</a><br/>'.
     232        $Output .='<h3>'.T('Translation team').' '.htmlspecialchars($Team['Name']).'</h3><br />'.
     233          T('Web pages').': <a href="http://'.htmlspecialchars($Team['URL']).'">'.htmlspecialchars($Team['URL']).'</a><br/>'.
    234234          T('Leader').': <a href="'.$this->System->Link('/user/?user='.$Leader['Id']).'">'.$Leader['Name'].'</a><br/>';
    235235        if($Team['Description'] != '')
    236           $Output .= T('Description').': '.$Team['Description'].'<br />';
     236          $Output .= T('Description').': '.htmlspecialchars($Team['Description']).'<br />';
    237237        $Output .= '<br />';
    238238        //$Output .= '<a href="export/?team='.$Team['Id'].'">Exportovat překlad týmu</a> ';
     
    241241        $XP = GetLevelMinMax($Team['AverageXP']);
    242242        $Output .='<fieldset><legend>'.T('Statistics').'</legend>'.
    243           T('Team member count').': <a href="'.$this->System->Link('/userlist/?team='.$Team['Id']).'" title="Zobrazit členy týmu">'.$Team['NumberUser'].'</a><br />'.
     243          T('Team member count').': <a href="'.$this->System->Link('/users/?team='.$Team['Id']).'" title="Zobrazit členy týmu">'.$Team['NumberUser'].'</a><br />'.
    244244          T('Team number of translated texts').': <strong>'.$Team['NumberTranslate'].'</strong><br />'.
    245245          T('Average level of team members').': <strong>'.$XP['Level'].'</strong> '.T('experience').': '.ProgressBar(150, round($XP['XP'] / $XP['MaxXP'] * 100, 2), $XP['XP'].' / '.$XP['MaxXP']).'<br />'.
Note: See TracChangeset for help on using the changeset viewer.