fix #1531 1532 1533 #1534 管理画面の文字列出力を改善

baserproject · Oct 26, 2020 · a99e67e · a99e67e
1 parent aef0c75
commit a99e67e
Show file tree

Hide file tree

Showing 8 changed files with 40 additions and 40 deletions.
diff --git a/app/webroot/theme/admin-third/Elements/admin/feed_details/index_row.php b/app/webroot/theme/admin-third/Elements/admin/feed_details/index_row.php
@@ -20,13 +20,13 @@
 	<td class="bca-table-listup__tbody-td" class="row-tools bca-table-listup__tbody-td">
 		<?php if ($this->BcBaser->isAdminUser()): ?>
 			<?php echo $this->BcForm->input('ListTool.batch_targets.' . $data['id'], ['type' => 'checkbox', 'label'=> '<span class="bca-visually-hidden">チェックする</span>', 'class' => 'batch-targets bca-checkbox__input', 'value' => $data['id']]) ?>
-		<?php endif ?>		
+		<?php endif ?>
 	</td>
 	<td class="bca-table-listup__tbody-td">
 		<?php if ($data['url']): ?>
-			<?php $this->BcBaser->link($data['name'], ['controller' => 'feed_details', 'action' => 'edit', $this->BcForm->value('FeedConfig.id'), $data['id']]) ?>
+			<?php $this->BcBaser->link($data['name'], ['controller' => 'feed_details', 'action' => 'edit', $this->BcForm->value('FeedConfig.id'), $data['id']], ['escape' => true]) ?>
 		<?php else: ?>
-			<?php echo $data['name'] ?>
+			<?php echo h($data['name']) ?>
 		<?php endif; ?>
 	</td>
 	<td class="bca-table-listup__tbody-td"><?php echo $data['category_filter'] ?></td>
@@ -39,4 +39,4 @@
 		<?php $this->BcBaser->link('', ['controller' => 'feed_details', 'action' => 'edit', $this->BcForm->value('FeedConfig.id'), $data['id']], ['title' => __d('baser', '編集'), 'class' => 'bca-btn-icon', 'data-bca-btn-type' => 'edit','data-bca-btn-size' => 'lg']) ?>
 		<?php $this->BcBaser->link('', ['controller' => 'feed_details', 'action' => 'ajax_delete', $this->BcForm->value('FeedConfig.id'), $data['id']], ['title' => __d('baser', '削除'), 'class' => 'btn-delete bca-btn-icon', 'data-bca-btn-type' => 'delete','data-bca-btn-size' => 'lg']) ?>
 	</td>
-</tr>
+</tr>
diff --git a/app/webroot/theme/admin-third/Elements/admin/sites/index_row.php b/app/webroot/theme/admin-third/Elements/admin/sites/index_row.php
@@ -26,7 +26,7 @@
 
 <tr id="Row<?php echo $count ?>" <?php echo $class; ?>>
 	<td class="bca-table-listup__tbody-td" style="width:5%"><?php echo $data['Site']['id']; ?></td>
-	<td class="bca-table-listup__tbody-td"><?php echo $data['Site']['display_name'] ?></td>
+	<td class="bca-table-listup__tbody-td"><?php echo h($data['Site']['display_name']) ?></td>
 	<td class="bca-table-listup__tbody-td"><?php $this->BcBaser->link($data['Site']['name'], ['action' => 'edit', $data['Site']['id']]); ?><br>
 		<?php echo $data['Site']['alias'] ?>
 	</td>
@@ -53,4 +53,4 @@
 <?php endif ?>
 		<?php $this->BcBaser->link('', ['action' => 'edit', $data['Site']['id']], ['title' => __d('baser', '編集'), 'class' => ' bca-btn-icon', 'data-bca-btn-type' => 'edit','data-bca-btn-size' => 'lg']) ?>
 	</td>
-</tr>
+</tr>
diff --git a/app/webroot/theme/admin-third/Elements/admin/uploader_categories/index_row.php b/app/webroot/theme/admin-third/Elements/admin/uploader_categories/index_row.php
@@ -19,7 +19,7 @@
 <?php endif ?>
 	</td>
 	<td class="bca-table-listup__tbody-td"><?php echo $data['UploaderCategory']['id'] ?></td>
-	<td class="bca-table-listup__tbody-td"><?php echo $data['UploaderCategory']['name'] ?></td>
+	<td class="bca-table-listup__tbody-td"><?php echo h($data['UploaderCategory']['name']) ?></td>
 	<?php echo $this->BcListTable->dispatchShowRow($data) ?>
 	<td class="bca-table-listup__tbody-td">
 		<?php echo $data['UploaderCategory']['created'] ?><br />

diff --git a/app/webroot/theme/admin-third/WidgetAreas/admin/form.php b/app/webroot/theme/admin-third/WidgetAreas/admin/form.php
@@ -58,7 +58,7 @@
 
 				<h2><?php echo __d('baser', '利用できるウィジェット') ?></h2>
 				<?php foreach ($widgetInfos as $widgetInfo) : ?>
-					<h3><?php echo $widgetInfo['title'] ?></h3>
+					<h3><?php echo h($widgetInfo['title']) ?></h3>
 					<?php
 					$widgets = [];
 					foreach ($widgetInfo['paths'] as $path) {
@@ -85,20 +85,20 @@
 					<?php foreach ($widgets as $widget): ?>
 
 						<div class="ui-widget-content draggable widget" id="Widget<?php echo Inflector::camelize($widget['name']) ?>">
-							<div class="head"><?php echo $widget['title'] ?></div>
+							<div class="head"><?php echo h($widget['title']) ?></div>
 						</div>
 
-						<div class="description"><?php echo $widget['description'] ?></div>
+						<div class="description"><?php echo h($widget['description']) ?></div>
 
-						<div class="ui-widget-content sortable widget template <?php echo $widget['name'] ?>" id="<?php echo Inflector::camelize($widget['name']) ?>">
+						<div class="ui-widget-content sortable widget template <?php echo h($widget['name']) ?>" id="<?php echo Inflector::camelize($widget['name']) ?>">
 							<div class="clearfix">
-								<div class="widget-name display-none"><?php echo $widget['name'] ?></div>
+								<div class="widget-name display-none"><?php echo h($widget['name']) ?></div>
 								<div class="del"><?php echo __d('baser', '削除') ?></div>
 								<div class="action"><?php echo __d('baser', '設定') ?></div>
-								<div class="head"><?php echo $widget['title'] ?></div>
+								<div class="head"><?php echo h($widget['title']) ?></div>
 							</div>
 							<div class="content" style="text-align:right">
-								<p class="widget-name"><small><?php echo $widget['title'] ?></small></p>
+								<p class="widget-name"><small><?php echo h($widget['title']) ?></small></p>
 								<?php echo $this->BcForm->create('Widget', ['url' => ['controller' => 'widget_areas', 'action' => 'update_widget', $this->BcForm->value('WidgetArea.id')], 'class' => 'form']) ?>
 								<?php echo $this->BcForm->input('Widget.id', ['type' => 'hidden', 'class' => 'id']) ?>
 								<?php echo $this->BcForm->input('Widget.type', ['type' => 'hidden', 'value' => $widget['title']]) ?>
@@ -134,15 +134,15 @@
 						<?php $key = key($widget) ?>
 						<?php $enabled = '' ?>
 						<?php if ($widget[$key]['status']): ?>
-				<?php $enabled = ' enabled' ?>
-			<?php endif ?>
+							<?php $enabled = ' enabled' ?>
+						<?php endif ?>
 
-						<div class="ui-widget-content sortable widget setting <?php echo $widget[$key]['element'] ?><?php echo $enabled ?>" id="Setting<?php echo $widget[$key]['id'] ?>">
+						<div class="ui-widget-content sortable widget setting <?php echo h($widget[$key]['element']) ?><?php echo $enabled ?>" id="Setting<?php echo $widget[$key]['id'] ?>">
 							<div class="clearfix">
-								<div class="widget-name display-none"><?php echo $widget[$key]['element'] ?></div>
+								<div class="widget-name display-none"><?php echo h($widget[$key]['element']) ?></div>
 								<div class="del"><?php echo __d('baser', '削除') ?></div>
 								<div class="action"><?php echo __d('baser', '設定') ?></div>
-								<div class="head"><?php echo $widget[$key]['name'] ?></div>
+								<div class="head"><?php echo h($widget[$key]['name']) ?></div>
 							</div>
 							<div class="content" style="text-align:right">
 								<p><small><?php echo $widget[$key]['type'] ?></small></p>
@@ -161,8 +161,8 @@
 								<?php echo $this->BcForm->end(['label' => __d('baser', '保存'), 'div' => false, 'id' => 'WidgetUpdateWidgetSubmit' . $widget[$key]['id'], 'class' => 'button bca-btn', 'data-bca-btn-type' => 'save']) ?></p>
 							</div>
 						</div>
-		<?php endforeach; ?>
-	<?php endif; ?>
+					<?php endforeach; ?>
+				<?php endif; ?>
 			</div>
 		</div>
 	</div>

diff --git a/lib/Baser/Plugin/Feed/View/Elements/admin/feed_details/index_row.php b/lib/Baser/Plugin/Feed/View/Elements/admin/feed_details/index_row.php
@@ -21,21 +21,21 @@
 	<td class="row-tools">
 		<?php if ($this->BcBaser->isAdminUser()): ?>
 			<?php echo $this->BcForm->checkbox('ListTool.batch_targets.' . $data['id'], array('type' => 'checkbox', 'class' => 'batch-targets', 'value' => $data['id'])) ?>
-		<?php endif ?>		
+		<?php endif ?>
 		<?php $this->BcBaser->link($this->BcBaser->getImg('admin/icn_tool_check.png', array('alt' => __d('baser', '確認'), 'class' => 'btn')), $data['url'], array('title' => __d('baser', '確認'), 'target' => '_blank')) ?>
 		<?php $this->BcBaser->link($this->BcBaser->getImg('admin/icn_tool_edit.png', array('alt' => __d('baser', '編集'), 'class' => 'btn')), array('controller' => 'feed_details', 'action' => 'edit', $this->BcForm->value('FeedConfig.id'), $data['id']), array('title' => __d('baser', '編集'))) ?>
 		<?php $this->BcBaser->link($this->BcBaser->getImg('admin/icn_tool_delete.png', array('alt' => __d('baser', '削除'), 'class' => 'btn')), array('controller' => 'feed_details', 'action' => 'ajax_delete', $this->BcForm->value('FeedConfig.id'), $data['id']), array('title' => __d('baser', '削除'), 'class' => 'btn-delete')) ?>
 	</td>
 	<td>
 		<?php if ($data['url']): ?>
-			<?php $this->BcBaser->link($data['name'], array('controller' => 'feed_details', 'action' => 'edit', $this->BcForm->value('FeedConfig.id'), $data['id'])) ?>
+			<?php $this->BcBaser->link($data['name'], array('controller' => 'feed_details', 'action' => 'edit', $this->BcForm->value('FeedConfig.id'), $data['id']), ['escape' => true]) ?>
 		<?php else: ?>
-			<?php echo $data['name'] ?>
+			<?php echo h($data['name']) ?>
 		<?php endif; ?>
 	</td>
 	<td><?php echo $data['category_filter'] ?></td>
 	<td><?php echo $this->BcText->listValue('FeedDetail.cache_time', $data['cache_time']) ?></td>
 	<?php echo $this->BcListTable->dispatchShowRow($data) ?>
 	<td><?php echo $this->BcTime->format('Y-m-d', $data['created']) ?><br />
 		<?php echo $this->BcTime->format('Y-m-d', $data['modified']) ?></td>
-</tr>
+</tr>
diff --git a/lib/Baser/View/Elements/admin/sites/index_row.php b/lib/Baser/View/Elements/admin/sites/index_row.php
@@ -34,9 +34,9 @@
 		<?php $this->BcBaser->link($this->BcBaser->getImg('admin/icn_tool_edit.png', ['alt' => __d('baser', '編集'), 'class' => 'btn']), ['action' => 'edit', $data['Site']['id']], ['title' => __d('baser', '編集')]) ?>
 	</td>
 	<td style="width:5%"><?php echo $data['Site']['id']; ?></td>
-	<td><?php echo $data['Site']['display_name'] ?></td>
-	<td><?php $this->BcBaser->link($data['Site']['name'], ['action' => 'edit', $data['Site']['id']]); ?><br>
-		<?php echo $data['Site']['alias'] ?>
+	<td><?php echo h($data['Site']['display_name']) ?></td>
+	<td><?php $this->BcBaser->link($data['Site']['name'], ['action' => 'edit', $data['Site']['id']], ['escape' => true]); ?><br>
+		<?php echo h($data['Site']['alias']) ?>
 	</td>
 	<td style="width:5%;" class="align-center status">
 		<?php echo $this->BcText->booleanMark($data['Site']['status']); ?><br />
@@ -53,4 +53,4 @@
 		<?php echo $this->BcTime->format('Y-m-d', $data['Site']['created']) ?><br />
 		<?php echo $this->BcTime->format('Y-m-d', $data['Site']['modified']) ?>
 	</td>
-</tr>
+</tr>
diff --git a/lib/Baser/View/Elements/admin/widget_areas/index_row.php b/lib/Baser/View/Elements/admin/widget_areas/index_row.php
@@ -25,8 +25,8 @@
 		<?php $this->BcBaser->link($this->BcBaser->getImg('admin/icn_tool_delete.png', ['alt' => __d('baser', '削除'), 'class' => 'btn']), ['action' => 'ajax_delete', $data['WidgetArea']['id']], ['title' => __d('baser', '削除'), 'class' => 'btn-delete']) ?>
 	</td>
 	<td><?php echo $data['WidgetArea']['id']; ?></td>
-	<td><?php $this->BcBaser->link($data['WidgetArea']['name'], ['action' => 'edit', $data['WidgetArea']['id']]); ?></td>
+	<td><?php $this->BcBaser->link($data['WidgetArea']['name'], ['action' => 'edit', $data['WidgetArea']['id']], ['escape' => true]); ?></td>
 	<td><?php echo $data['WidgetArea']['count']; ?></td>
 	<td><?php echo $this->BcTime->format('Y-m-d', $data['WidgetArea']['created']); ?><br />
 		<?php echo $this->BcTime->format('Y-m-d', $data['WidgetArea']['modified']); ?></td>
-</tr>
+</tr>
diff --git a/lib/Baser/View/WidgetAreas/admin/form.php b/lib/Baser/View/WidgetAreas/admin/form.php
@@ -59,7 +59,7 @@
 
 				<h2><?php echo __d('baser', '利用できるウィジェット')?></h2>
 				<?php foreach ($widgetInfos as $widgetInfo) : ?>
-					<h3><?php echo $widgetInfo['title'] ?></h3>
+					<h3><?php echo h($widgetInfo['title']) ?></h3>
 					<?php
 					$widgets = [];
 					foreach ($widgetInfo['paths'] as $path) {
@@ -86,20 +86,20 @@
 					<?php foreach ($widgets as $widget): ?>
 
 						<div class="ui-widget-content draggable widget" id="Widget<?php echo Inflector::camelize($widget['name']) ?>">
-							<div class="head"><?php echo $widget['title'] ?></div>
+							<div class="head"><?php echo h($widget['title']) ?></div>
 						</div>
 
-						<div class="description"><?php echo $widget['description'] ?></div>
+						<div class="description"><?php echo h($widget['description']) ?></div>
 
-						<div class="ui-widget-content sortable widget template <?php echo $widget['name'] ?>" id="<?php echo Inflector::camelize($widget['name']) ?>">
+						<div class="ui-widget-content sortable widget template <?php echo h($widget['name']) ?>" id="<?php echo Inflector::camelize($widget['name']) ?>">
 							<div class="clearfix">
-								<div class="widget-name display-none"><?php echo $widget['name'] ?></div>
+								<div class="widget-name display-none"><?php echo h($widget['name']) ?></div>
 								<div class="del"><?php echo __d('baser', '削除')?></div>
 								<div class="action"><?php echo __d('baser', '設定')?></div>
 								<div class="head"><?php echo $widget['title'] ?></div>
 							</div>
 							<div class="content" style="text-align:right">
-								<p class="widget-name"><small><?php echo $widget['title'] ?></small></p>
+								<p class="widget-name"><small><?php echo h($widget['title']) ?></small></p>
 								<?php echo $this->BcForm->create('Widget', ['url' => ['controller' => 'widget_areas', 'action' => 'update_widget', $this->BcForm->value('WidgetArea.id')], 'class' => 'form']) ?>
 								<?php echo $this->BcForm->input('Widget.id', ['type' => 'hidden', 'class' => 'id']) ?>
 								<?php echo $this->BcForm->input('Widget.type', ['type' => 'hidden', 'value' => $widget['title']]) ?>
@@ -138,12 +138,12 @@
 				<?php $enabled = ' enabled' ?>
 			<?php endif ?>
 
-						<div class="ui-widget-content sortable widget setting <?php echo $widget[$key]['element'] ?><?php echo $enabled ?>" id="Setting<?php echo $widget[$key]['id'] ?>">
+						<div class="ui-widget-content sortable widget setting <?php echo h($widget[$key]['element']) ?><?php echo $enabled ?>" id="Setting<?php echo $widget[$key]['id'] ?>">
 							<div class="clearfix">
-								<div class="widget-name display-none"><?php echo $widget[$key]['element'] ?></div>
+								<div class="widget-name display-none"><?php echo h($widget[$key]['element']) ?></div>
 								<div class="del"><?php echo __d('baser', '削除')?></div>
 								<div class="action"><?php echo __d('baser', '設定')?></div>
-								<div class="head"><?php echo $widget[$key]['name'] ?></div>
+								<div class="head"><?php echo h($widget[$key]['name']) ?></div>
 							</div>
 							<div class="content" style="text-align:right">
 								<p><small><?php echo $widget[$key]['type'] ?></small></p>