[Templates] Escape sitename (#21008)

joomla · Jul 11, 2018 · 364c9e8 · 364c9e8
1 parent c3349f2
commit 364c9e8
Show file tree

Hide file tree

Showing 4 changed files with 6 additions and 6 deletions.
diff --git a/administrator/templates/isis/error.php b/administrator/templates/isis/error.php
@@ -32,7 +32,7 @@
 $layout   = $input->get('layout', '');
 $task     = $input->get('task', '');
 $itemid   = $input->get('Itemid', 0, 'int');
-$sitename = $app->get('sitename');
+$sitename = htmlspecialchars($app->get('sitename'), ENT_QUOTES, 'UTF-8');
 
 $cpanel = ($option === 'com_cpanel');
 

diff --git a/templates/protostar/error.php b/templates/protostar/error.php
@@ -23,7 +23,7 @@
 $layout   = $app->input->getCmd('layout', '');
 $task     = $app->input->getCmd('task', '');
 $itemid   = $app->input->getCmd('Itemid', '');
-$sitename = $app->get('sitename');
+$sitename = htmlspecialchars($app->get('sitename'), ENT_QUOTES, 'UTF-8');
 
 if ($task === 'edit' || $layout === 'form')
 {

diff --git a/templates/protostar/index.php b/templates/protostar/index.php
@@ -26,7 +26,7 @@
 $layout   = $app->input->getCmd('layout', '');
 $task     = $app->input->getCmd('task', '');
 $itemid   = $app->input->getCmd('Itemid', '');
-$sitename = $app->get('sitename');
+$sitename = htmlspecialchars($app->get('sitename'), ENT_QUOTES, 'UTF-8');
 
 if ($task === 'edit' || $layout === 'form')
 {

diff --git a/templates/protostar/offline.php b/templates/protostar/offline.php
@@ -75,7 +75,7 @@
 JHtml::_('bootstrap.loadCss', false, $this->direction);
 
 // Logo file or site title param
-$sitename = $app->get('sitename');
+$sitename = htmlspecialchars($app->get('sitename'), ENT_QUOTES, 'UTF-8');
 
 if ($this->params->get('logoFile'))
 {
@@ -104,10 +104,10 @@
 				<?php if (!empty($logo)) : ?>
 					<h1><?php echo $logo; ?></h1>
 				<?php else : ?>
-					<h1><?php echo htmlspecialchars($app->get('sitename')); ?></h1>
+					<h1><?php echo $sitename; ?></h1>
 				<?php endif; ?>
 				<?php if ($app->get('offline_image') && file_exists($app->get('offline_image'))) : ?>
-					<img src="<?php echo $app->get('offline_image'); ?>" alt="<?php echo htmlspecialchars($app->get('sitename')); ?>" />
+					<img src="<?php echo $app->get('offline_image'); ?>" alt="<?php echo $sitename; ?>" />
 				<?php endif; ?>
 				<?php if ($app->get('display_offline_message', 1) == 1 && str_replace(' ', '', $app->get('offline_message')) !== '') : ?>
 					<p><?php echo $app->get('offline_message'); ?></p>