Skip to content
This repository was archived by the owner on Sep 10, 2021. It is now read-only.

Commit 4a1b968

Browse files
author
Jamie Snape
committed
Escape variables in packages module
1 parent 2e86efb commit 4a1b968

File tree

5 files changed

+31
-31
lines changed

5 files changed

+31
-31
lines changed

‎modules/packages/views/application/latest.phtml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,8 @@ $this->headScript()->appendFile($this->moduleWebroot.'/public/js/application/pac
3232
<div id="platformList" style="display: none;">
3333
<?php
3434
foreach ($this->platforms as $platform) {
35-
echo '<h3 os="'.$platform['os'].'" arch="'.$platform['arch'].'"><a href="#"></a></h3>';
36-
echo '<div class="platformContainer" os="'.$platform['os'].'" arch="'.$platform['arch'].'">';
35+
echo '<h3 os="'.$this->escape($platform['os']).'" arch="'.$this->escape($platform['arch']).'"><a href="#"></a></h3>';
36+
echo '<div class="platformContainer" os="'.$this->escape($platform['os']).'" arch="'.$this->escape($platform['arch']).'">';
3737
echo '</div>';
3838
}
3939
?>

‎modules/packages/views/application/view.phtml‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -28,11 +28,11 @@ $this->headScript()->appendFile($this->moduleWebroot.'/public/js/application/pac
2828
<div class="viewMain">
2929
<div class="titleWrapper">
3030
<div class="applicationName">
31-
<?php echo $this->application->getName(); ?>
31+
<?php echo $this->escape($this->application->getName()); ?>
3232
</div>
3333
<?php
3434
if ($this->application->getDescription() != '') {
35-
echo '<div class="applicationDescription">'.$this->application->getDescription().'</div>';
35+
echo '<div class="applicationDescription">'.$this->escape($this->application->getDescription()).'</div>';
3636
}
3737
?>
3838
</div>
@@ -41,8 +41,8 @@ $this->headScript()->appendFile($this->moduleWebroot.'/public/js/application/pac
4141
<div id="packageList" style="display: none;">
4242
<?php
4343
foreach ($this->releases as $release) {
44-
echo '<h3><a href="#">Version '.$release.'</a></h3>';
45-
echo '<div class="releaseEntry" element="'.$release.'">';
44+
echo '<h3><a href="#">Version '.$this->escape($release).'</a></h3>';
45+
echo '<div class="releaseEntry" element="'.$this->escape($release).'">';
4646
echo '</div>';
4747
}
4848
?>
@@ -74,8 +74,8 @@ $this->headScript()->appendFile($this->moduleWebroot.'/public/js/application/pac
7474
<h1>Actions</h1>
7575
<ul>
7676
<li>
77-
<a href="<?php echo $this->webroot; ?>/packages/application/latest?applicationId=<?php echo $this->application->getKey(
78-
); ?>">
77+
<a href="<?php echo $this->webroot; ?>/packages/application/latest?applicationId=<?php echo $this->escape($this->application->getKey(
78+
)); ?>">
7979
<img alt="" src="<?php echo $this->coreWebroot; ?>/public/images/icons/time.png"/>
8080
Latest nightly packages
8181
</a>
@@ -102,18 +102,18 @@ $this->headScript()->appendFile($this->moduleWebroot.'/public/js/application/pac
102102
<tr>
103103
<td>Name</td>
104104
<td>
105-
<input type="text" name="name" value="<?php echo $this->application->getName(); ?>"/>
105+
<input type="text" name="name" value="<?php echo $this->escape($this->application->getName()); ?>"/>
106106
</td>
107107
</tr>
108108
<tr>
109109
<td>Description</td>
110110
<td>
111-
<textarea class="expanding" name="description"><?php echo htmlentities(
111+
<textarea class="expanding" name="description"><?php echo $this->escape(
112112
$this->application->getDescription()
113113
); ?></textarea></td>
114114
</tbody>
115115
</table>
116-
<input type="hidden" name="applicationId" value="<?php echo $this->application->getKey(); ?>"/>
116+
<input type="hidden" name="applicationId" value="<?php echo $this->escape($this->application->getKey()); ?>"/>
117117
<input type="submit" class="globalButton" value="Save"/>
118118
</form>
119119
</div>
@@ -126,7 +126,7 @@ $this->headScript()->appendFile($this->moduleWebroot.'/public/js/application/pac
126126
will be deleted, but the underlying item data will remain in place.
127127
</div>
128128
<br/><br/>
129-
<input type="hidden" name="applicationId" value="<?php echo $this->application->getKey(); ?>"/>
129+
<input type="hidden" name="applicationId" value="<?php echo $this->escape($this->application->getKey()); ?>"/>
130130

131131
<div style="float: right;">
132132
<input style="margin-left: 0;" type="submit" class="globalButton" value="Delete"/>

‎modules/packages/views/index/viewsidebar.phtml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
<h1>Stats</h1>
2626
<ul>
2727
<?php
28-
echo " <li>{$this->nPackages} {$this->t('package')}".(($this->nPackages > 1) ? 's' : '')."</li>";
28+
echo " <li>{$this->escape($this->nPackages)} {$this->t('package')}".(($this->nPackages > 1) ? 's' : '')."</li>";
2929
?>
3030
</ul>
3131
</div>

‎modules/packages/views/package/manage.phtml‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -26,8 +26,8 @@ $this->headScript()->appendFile($this->moduleWebroot.'/public/js/package/package
2626
<div class="viewMain">
2727
<div class="headerSection">
2828
<h2>Package Metadata</h2>
29-
<a href="<?php echo $this->webroot.'/item/'.$this->package->getItem()->getKey(); ?>">
30-
<?php echo $this->package->getItem()->getName(); ?>
29+
<a href="<?php echo $this->webroot.'/item/'.$this->escape($this->package->getItem()->getKey()); ?>">
30+
<?php echo $this->escape($this->package->getItem()->getName()); ?>
3131
</a>
3232
</div>
3333
<form class="genericForm packageEdit" method="POST" action="<?php echo $this->webroot; ?>/packages/package/save">
@@ -36,62 +36,62 @@ $this->headScript()->appendFile($this->moduleWebroot.'/public/js/package/package
3636
<tr>
3737
<td>OS</td>
3838
<td>
39-
<input type="text" name="os" value="<?php echo $this->package->getOs(); ?>"/>
39+
<input type="text" name="os" value="<?php echo $this->escape($this->package->getOs()); ?>"/>
4040
</td>
4141
</tr>
4242
<tr>
4343
<td>Architecture</td>
4444
<td>
45-
<input type="text" name="arch" value="<?php echo $this->package->getArch(); ?>"/>
45+
<input type="text" name="arch" value="<?php echo $this->escape($this->package->getArch()); ?>"/>
4646
</td>
4747
</tr>
4848
<tr>
4949
<td>Revision</td>
5050
<td>
51-
<input type="text" name="revision" value="<?php echo $this->package->getRevision(); ?>"/>
51+
<input type="text" name="revision" value="<?php echo $this->escape($this->package->getRevision()); ?>"/>
5252
</td>
5353
</tr>
5454
<tr>
5555
<td>Submission Type</td>
5656
<td>
5757
<input type="text" name="submissiontype"
58-
value="<?php echo $this->package->getSubmissiontype(); ?>"/>
58+
value="<?php echo $this->escape($this->package->getSubmissiontype()); ?>"/>
5959
</td>
6060
</tr>
6161
<tr>
6262
<td>Package Type</td>
6363
<td>
64-
<input type="text" name="packagetype" value="<?php echo $this->package->getPackagetype(); ?>"/>
64+
<input type="text" name="packagetype" value="<?php echo $this->escape($this->package->getPackagetype()); ?>"/>
6565
</td>
6666
</tr>
6767
<tr>
6868
<td>Product Name</td>
6969
<td>
70-
<input type="text" name="productname" value="<?php echo $this->package->getProductname(); ?>"/>
70+
<input type="text" name="productname" value="<?php echo$this->escape($this->package->getProductname()); ?>"/>
7171
</td>
7272
</tr>
7373
<tr>
7474
<td>Codebase</td>
7575
<td>
76-
<input type="text" name="codebase" value="<?php echo $this->package->getCodebase(); ?>"/>
76+
<input type="text" name="codebase" value="<?php echo $this->escape($this->package->getCodebase()); ?>"/>
7777
</td>
7878
</tr>
7979
<tr>
8080
<td>Checkout Date</td>
8181
<td>
82-
<input type="text" name="checkoutdate" value="<?php echo $this->package->getCheckoutdate(); ?>"/>
82+
<input type="text" name="checkoutdate" value="<?php echo $this->escape($this->package->getCheckoutdate()); ?>"/>
8383
</td>
8484
</tr>
8585
<tr>
8686
<td>Release Tag</td>
8787
<td>
88-
<input type="text" name="release" value="<?php echo $this->package->getRelease(); ?>"/>
88+
<input type="text" name="release" value="<?php echo $this->escape($this->package->getRelease()); ?>"/>
8989
</td>
9090
</tr>
9191
</tbody>
9292
</table>
9393
<br/>
94-
<input type="hidden" name="packageId" value="<?php echo $this->package->getKey(); ?>"/>
94+
<input type="hidden" name="packageId" value="<?php echo $this->escape($this->package->getKey()); ?>"/>
9595
<input class="globalButton" type="submit" value="Save"/>
9696
</form>
9797
</div>

‎modules/packages/views/view/project.phtml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@
2626
href="<?php echo $this->moduleWebroot ?>/public/css/view/packages.view.project.css"/>
2727

2828
<div class="packagesTabWrapper">
29-
<div class="introText">The <?php echo $this->community->getName(); ?> project hosts packages for the following
29+
<div class="introText">The <?php echo $this->escape($this->community->getName()); ?> project hosts packages for the following
3030
applications:
3131
</div>
3232

@@ -38,11 +38,11 @@
3838

3939
foreach ($this->applications as $application) {
4040
echo '<div class="applicationContainer">';
41-
echo '<a class="applicationLink" href="'.$this->webroot.'/packages/application/view?applicationId='.$application->getKey(
42-
).'">';
43-
echo $application->getName().'</a>';
41+
echo '<a class="applicationLink" href="'.$this->webroot.'/packages/application/view?applicationId='.$this->escape($application->getKey(
42+
)).'">';
43+
echo $this->escape($application->getName()).'</a>';
4444
if ($application->getDescription() != '') {
45-
echo '<div class="applicationDescription">'.$application->getDescription().'</div>';
45+
echo '<div class="applicationDescription">'.$this->escape($application->getDescription()).'</div>';
4646
}
4747
echo '</div>';
4848
}
@@ -75,7 +75,7 @@
7575
</td>
7676
</tbody>
7777
</table>
78-
<input type="hidden" name="projectId" value="<?php echo $this->project->getKey(); ?>"/>
78+
<input type="hidden" name="projectId" value="<?php echo $this->escape($this->project->getKey()); ?>"/>
7979
<input type="submit" class="globalButton" value="Create"/>
8080
</form>
8181
</div>

0 commit comments

Comments
 (0)