Merge pull request symphonycms#1551 from designermonkey/params-cdata

Altered querystring CDATA wrapping until just before processing. RE symphonycms#1480
alpacaaa · Nov 14, 2012 · 977f9e2 · 977f9e2
2 parents 9b117cf + 30db8d2
commit 977f9e2
Show file tree

Hide file tree

Showing 2 changed files with 23 additions and 2 deletions.
diff --git a/symphony/lib/toolkit/class.frontendpage.php b/symphony/lib/toolkit/class.frontendpage.php
@@ -233,8 +233,14 @@ public function generate($page) {
 				 */
 				Symphony::ExtensionManager()->notifyMembers('FrontendPreRenderHeaders', '/frontend/');
 
+				$backup_param = $this->_param;
+
+				$this->_param['current-query-string'] = General::wrapInCDATA($this->_param['current-query-string']);
+
 				$output = parent::generate();
 
+				$this->_param = $backup_param;
+
 				/**
 				 * Immediately after generating the page. Provided with string containing page source
 				 * @delegate FrontendOutputPostGenerate
@@ -344,7 +350,7 @@ private function __buildPage(){
 				'current-page-id' => $page['id'],
 				'current-path' => ($current_path == '') ? '/' : $current_path,
 				'parent-path' => '/' . $page['path'],
-				'current-query-string' => '<![CDATA[' . self::sanitizeParameter($querystring) . ']]>',
+				'current-query-string' => self::sanitizeParameter($querystring),
 				'current-url' => URL . $current_path,
 				'upload-limit' => min($upload_size_php, $upload_size_sym),
 				'symphony-version' => Symphony::Configuration()->get('version', 'symphony'),
@@ -481,7 +487,7 @@ private function __buildPage(){
 					$param->setValue(General::sanitize($value[0]));
 				}
 				else if($key == 'current-query-string') {
-					$param->setValue($value);
+					$param->setValue(General::wrapInCDATA($value));
 				}
 				else {
 					$param->setValue(General::sanitize($value));
@@ -1000,3 +1006,4 @@ public static function resolvePageFileLocation($path, $handle) {
 		}
 
 	}
+
diff --git a/symphony/lib/toolkit/class.general.php b/symphony/lib/toolkit/class.general.php
@@ -1327,4 +1327,18 @@ public static function ensureType(array $params){
 
 			}
 		}
+
+		/**
+		 * Wrap a value in CDATA tags for XSL output of non encoded data
+		 *
+		 * @since Symphony 2.3.2
+		 * @param string @value
+		 *	The string to wrap in CDATA
+		 * @return string
+		 *	The wrapped string
+		 */
+		public static function wrapInCDATA($value) {
+			return '<![CDATA[' . $value . ']]>';
+		}
+
 	}