hyung-hwan/codepot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fixed input form value escaping in various files

Browse Source
This commit is contained in:
hyung-hwan 2022-04-15 07:35:12 +00:00
parent ebe8391ab0
commit 94e17633b2
6 changed files with 13 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
codepot/src/codepot/views/code_folder.php
View File

@ -1474,7 +1474,7 @@ $this->load->view (
if (isset($login['id']) && $login['id'] != '') if (isset($login['id']) && $login['id'] != '')
{ {
print '<td align="middle">'; print '<td align="middle">';
printf ('<input type="checkbox" name="code_folder_file_%d" value="%s" class="file_selector" id="code_folder_result_table_file_selector_%d" />', $rownum, addslashes($f['name']), $rownum); printf ('<input type="checkbox" name="code_folder_file_%d" value="%s" class="file_selector" id="code_folder_result_table_file_selector_%d" />', $rownum, htmlspecialchars($f['name']), $rownum);
print '</td>'; print '</td>';
} }
print '<td>'; print '<td>';
@ -1507,7 +1507,7 @@ $this->load->view (
if (isset($login['id']) && $login['id'] != '') if (isset($login['id']) && $login['id'] != '')
{ {
print '<td align="middle">'; print '<td align="middle">';
printf ('<input type="checkbox" name="code_folder_file_%d", value="%s" class="file_selector" id="code_folder_result_table_file_selector_%d" />', $rownum, addslashes($f['name']), $rownum); printf ('<input type="checkbox" name="code_folder_file_%d", value="%s" class="file_selector" id="code_folder_result_table_file_selector_%d" />', $rownum, htmlspecialchars($f['name']), $rownum);
print '</td>'; print '</td>';
} }
print '<td>'; print '<td>';

6
codepot/src/codepot/views/file_show.php
View File

@ -698,8 +698,8 @@ $this->load->view (
<div id='file_show_edit_form'> <div id='file_show_edit_form'>
<div style='line-height: 2em;'> <div style='line-height: 2em;'>
<?php print $this->lang->line('Tag'); ?>: <input type='text' id='file_show_edit_tag' name='file_show_edit_tag' size='30' value='<?php print addslashes($file->tag); ?>'/> <?php print $this->lang->line('Tag'); ?>: <input type='text' id='file_show_edit_tag' name='file_show_edit_tag' size='30' value="<?php print htmlspecialchars($file->tag); ?>"/>
<?php print $this->lang->line('Name'); ?>: <input type='text' id='file_show_edit_name' name='file_show_edit_name' size='60' value='<?php print addslashes($file->name); ?>'/> <?php print $this->lang->line('Name'); ?>: <input type='text' id='file_show_edit_name' name='file_show_edit_name' size='60' value="<?php print htmlspecialchars($file->name); ?>"/>
</div> </div>
<div id='file_show_edit_description_tabs' style='width:100%;'> <div id='file_show_edit_description_tabs' style='width:100%;'>
@ -739,7 +739,7 @@ $this->load->view (
print '</td><td>'; print '</td><td>';
printf ('<span id="file_show_edit_file_name_%d">%s</span>', $i, htmlspecialchars($f->filename)); printf ('<span id="file_show_edit_file_name_%d">%s</span>', $i, htmlspecialchars($f->filename));
print '</td><td>'; print '</td><td>';
printf ('<input type="text" id="file_show_edit_file_desc_%d" value="%s" size="40" autocomplete="off" />', $i, addslashes($f->description)); printf ('<input type="text" id="file_show_edit_file_desc_%d" value="%s" size="40" autocomplete="off" />', $i, htmlspecialchars($f->description));
print '</td></tr>'; print '</td></tr>';
} }
?> ?>

8
codepot/src/codepot/views/issue_show.php
View File

@ -1158,7 +1158,7 @@ function print_issue_state ($con, $issue, $old, $issue_type_array, $issue_status
{ {
print "<div id='issue_show_edit_comment_form_{$i}'>"; print "<div id='issue_show_edit_comment_form_{$i}'>";
printf ('<a href="#" id="issue_show_edit_comment_preview_button_%d">%s</a>', $i, $this->lang->line('Preview')); printf ('<a href="#" id="issue_show_edit_comment_preview_button_%d">%s</a>', $i, $this->lang->line('Preview'));
printf ('<input type="hidden" id="issue_show_edit_comment_sno_%d" value="%s" />', $i, addslashes($new->sno)); printf ('<input type="hidden" id="issue_show_edit_comment_sno_%d" value="%s" />', $i, htmlspecialchars($new->sno));
printf ('<textarea id="issue_show_edit_comment_text_%d" class="codepot-issue-edit-comment" rows="20">%s</textarea>', $i, $escaped_comment); printf ('<textarea id="issue_show_edit_comment_text_%d" class="codepot-issue-edit-comment" rows="20">%s</textarea>', $i, $escaped_comment);
printf ('<div id="issue_show_edit_comment_preview_%d" class="codepot-styled-text-preview"></div>', $i); printf ('<div id="issue_show_edit_comment_preview_%d" class="codepot-styled-text-preview"></div>', $i);
print '</div>'; print '</div>';
@ -1196,7 +1196,9 @@ function print_issue_state ($con, $issue, $old, $issue_type_array, $issue_status
'id="issue_show_edit_type" disabled="disabled"' 'id="issue_show_edit_type" disabled="disabled"'
); );
?> ?>
<input type='text' id='issue_show_edit_summary' name='issue_show_edit_summary' size='50' placeholder='<?php print $this->lang->line('Summary'); ?>' value='<?php print addslashes($issue->summary); ?>'/>
<?php print htmlspecialchars($issue->summary); ?>
<input type='text' id='issue_show_edit_summary' name='issue_show_edit_summary' size='50' placeholder='<?php print $this->lang->line('Summary'); ?>' value="<?php print htmlspecialchars($issue->summary); ?>"/>
</div> </div>
<div id='issue_show_edit_description_tabs' style='width:100%;'> <div id='issue_show_edit_description_tabs' style='width:100%;'>
@ -1238,7 +1240,7 @@ function print_issue_state ($con, $issue, $old, $issue_type_array, $issue_status
print '</td><td>'; print '</td><td>';
printf ('<span id="issue_show_edit_file_name_%d">%s</span>', $i, htmlspecialchars($f->filename)); printf ('<span id="issue_show_edit_file_name_%d">%s</span>', $i, htmlspecialchars($f->filename));
print '</td><td>'; print '</td><td>';
printf ('<input type="text" id="issue_show_edit_file_desc_%d" value="%s" size="40" autocomplete="off" />', $i, addslashes($f->description)); printf ('<input type="text" id="issue_show_edit_file_desc_%d" value="%s" size="40" autocomplete="off" />', $i, htmlspecialchars($f->description));
print '</td></tr>'; print '</td></tr>';
} }
?> ?>

2
codepot/src/codepot/views/user_settings.php
View File

@ -83,7 +83,7 @@ $this->load->view (
<hr style="height:1px; border:none; background-color:#CCCCCC;" /> <hr style="height:1px; border:none; background-color:#CCCCCC;" />
<?php print form_label($this->lang->line('Oneliner about me').': ', 'user_summary')?> <?php print form_label($this->lang->line('Oneliner about me').': ', 'user_summary')?>
<input type="text" name="user_summary" size="50" value="<?php print addslashes($settings->user_summary); ?>" /> <input type="text" name="user_summary" size="50" value="<?php print htmlspecialchars($settings->user_summary); ?>" />
<hr style="height:1px; border:none; background-color:#CCCCCC;" /> <hr style="height:1px; border:none; background-color:#CCCCCC;" />

2
codepot/src/codepot/views/wiki_edit.php
View File

@ -533,7 +533,7 @@ $this->load->view (
<option value="C">WikiCreole</option> <option value="C">WikiCreole</option>
<option value="M">Markdown</option> <option value="M">Markdown</option>
</select> </select>
<input type="text" name="wiki_name" value="<?php print addslashes($wiki->name); ?>" maxlength="80" size="40" id="wiki_edit_name" placeholder="<?php print $this->lang->line('Name'); ?>" /> <input type="text" name="wiki_name" value="<?php print htmlspecialchars($wiki->name); ?>" maxlength="80" size="40" id="wiki_edit_name" placeholder="<?php print $this->lang->line('Name'); ?>" />
</div> </div>
<div class="actions"> <div class="actions">

2
codepot/src/codepot/views/wiki_editx.php
View File

@ -592,7 +592,7 @@ $this->load->view (
<div class="mainarea" id="wiki_edit_mainarea"> <div class="mainarea" id="wiki_edit_mainarea">
<div class="codepot-title-band" id="wiki_edit_title_band"> <div class="codepot-title-band" id="wiki_edit_title_band">
<div class="title"><input type="text" name="wiki_name" value="<?php print addslashes($wiki->name); ?>" maxlength="80" size="40" id="wiki_edit_name" placeholder="<?php print $this->lang->line('Name'); ?>" /></div> <div class="title"><input type="text" name="wiki_name" value="<?php print htmlspecialchars($wiki->name); ?>" maxlength="80" size="40" id="wiki_edit_name" placeholder="<?php print $this->lang->line('Name'); ?>" /></div>
<div class="actions"> <div class="actions">
<a id="wiki_edit_save_button" href='#'><?php print $this->lang->line('Save')?></a> <a id="wiki_edit_save_button" href='#'><?php print $this->lang->line('Save')?></a>