bug fixes (#5846)

openemr · Oct 19, 2022 · 37d7ed4 · 37d7ed4
1 parent 3bd4b97
commit 37d7ed4
Show file tree

Hide file tree

Showing 4 changed files with 8 additions and 8 deletions.
diff --git a/interface/main/messages/messages.php b/interface/main/messages/messages.php
@@ -115,7 +115,7 @@
         echo "<title>" . xlt('MedEx Setup') . "</title>";
         $stage = $_REQUEST['stage'];
         if (!is_numeric($stage)) {
-            echo "<br /><span class='title'>$stage " . xlt('Warning') . ": " . xlt('This is not a valid request') . ".</span>";
+            echo "<br /><span class='title'>" . text($stage) . " " . xlt('Warning') . ": " . xlt('This is not a valid request') . ".</span>";
         } else {
             $MedEx->setup->MedExBank($stage);
         }

diff --git a/interface/main/messages/save.php b/interface/main/messages/save.php
@@ -248,7 +248,7 @@
             sqlQuery($sql, array('recall_' . $pid, $_POST['item'], $_SESSION['authUserID'], 'Label printed locally'));
         }
     }
-    echo json_encode($pidList);
+    echo text(json_encode($pidList));
     exit;
 }
 if ($_REQUEST['go'] == "Messages") {

diff --git a/interface/patient_file/front_payment_cc.php b/interface/patient_file/front_payment_cc.php
@@ -53,7 +53,7 @@
         exit();
     }
 
-    echo $ccaudit;
+    echo text($ccaudit);
     exit();
 }
 

diff --git a/library/classes/TreeMenu.php b/library/classes/TreeMenu.php
@@ -680,17 +680,17 @@ function _nodeToHTML($nodeObj, $prefix, $return = 'newNode', $currentDepth = 0,
         $expanded  = $this->isDynamic ? ($nodeObj->expanded  ? 'true' : 'false') : 'true';
         $isDynamic = $this->isDynamic ? ($nodeObj->isDynamic ? 'true' : 'false') : 'false';
         $html = sprintf(
-            "\t %s = %s.addItem(new TreeNode('%s', %s, %s, %s, %s, '%s', '%s', %s));\n",
+            "\t %s = %s.addItem(new TreeNode(jsAttr(%s), jsAttr(%s), jsAttr(%s), %s, %s, '%s', '%s', jsAttr(%s)));\n",
             $return,
             $prefix,
-            attr($nodeObj->text),
-            !empty($nodeObj->icon) ? "'" . $nodeObj->icon . "'" : 'null',
-            !empty($nodeObj->link) ? "'" . attr($nodeObj->link) . "'" : 'null',
+            js_escape($nodeObj->text),
+            !empty($nodeObj->icon) ?  js_escape($nodeObj->icon) : 'null',
+            !empty($nodeObj->link) ? js_escape($nodeObj->link) : 'null',
             $expanded,
             $isDynamic,
             $nodeObj->cssClass,
             $nodeObj->linkTarget,
-            !empty($nodeObj->expandedIcon) ? "'" . $nodeObj->expandedIcon . "'" : 'null'
+            !empty($nodeObj->expandedIcon) ? js_escape($nodeObj->expandedIcon) : 'null'
         );
 
         foreach ($nodeObj->events as $event => $handler) {