Skip to content
This repository has been archived by the owner on Apr 13, 2023. It is now read-only.

XSS prevention: escaping in phtml. Use $block instead $this. #7

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

XSS prevention: escaping in phtml. Use $block instead $this. #7

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions view/adminhtml/templates/config/form/validate.phtml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,10 +31,10 @@
*/
?>

<span id="message_span" data-mage-init='{"glsValidate": {"url": "<?php echo $this->getValidateUrl(); ?>"}}'>
<span id="message_span" data-mage-init='{"glsValidate": {"url": "<?php echo $block->escapeUrl($block->getValidateUrl()); ?>"}}'>
<div class="loader"></div>
<span class="validation-message unknown"><?php echo __('Validating API credentials'); ?></span>
<span class="validation-message error" style="display: none;"><?php echo __('API credentials are incorrect'); ?></span>
<span class="validation-message unable-to-retrieve" style="display: none;"><?php echo __('Unable to validate API credentials'); ?></span>
<span class="validation-message success" style="display: none;"><?php echo __('API credentials are correct'); ?></span>
<span class="validation-message unknown"><?php echo $block->escapeHtml(__('Validating API credentials')); ?></span>
<span class="validation-message error" style="display: none;"><?php echo $block->escapeHtml(__('API credentials are incorrect')); ?></span>
<span class="validation-message unable-to-retrieve" style="display: none;"><?php echo $block->escapeHtml(__('Unable to validate API credentials')); ?></span>
<span class="validation-message success" style="display: none;"><?php echo $block->escapeHtml(__('API credentials are correct')); ?></span>
</span>
29 changes: 16 additions & 13 deletions view/adminhtml/templates/config/support/tab.phtml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
<?php
/** @var \TIG\GLS\Block\Adminhtml\Config\Support\Tab $this */
/** @var \TIG\GLS\Block\Adminhtml\Config\Support\Tab $block */
?>
<div id="supporttab" class="tig-gls-supporttab" data-mage-init='{"glsConfig": true}'>

Expand All @@ -13,32 +13,32 @@
<span class="text">
<?php echo $block->escapeHtml(__('Supported Magento versions'));?>:
</span>
<span class="version"><?php echo $block->escapeHtml($this->getSupportedMagentoVersions()); ?></span>
<span class="version"><?php echo $block->escapeHtml($block->getSupportedMagentoVersions()); ?></span>
</li>
<li>
<span class="text"><?php echo $block->escapeHtml(__('Extension version'));?>:</span>
<span class="version"><?php echo $block->escapeHtml($this->getVersionNumber()); ?></span>
<span class="version"><?php echo $block->escapeHtml($block->getVersionNumber()); ?></span>
</li>
<span class="text"><?php echo $block->escapeHtml(__('Your PHP version'));?>:</span>
<span class="version">
<a href="http://devdocs.magento.com/guides/v<?php echo $this->getMagentoVersionTidyString() ;?>/install-gde/system-requirements-tech.html"
<a href="http://devdocs.magento.com/guides/v<?php echo $block->getMagentoVersionTidyString() ;?>/install-gde/system-requirements-tech.html"
target="_blank">
<?php echo $block->escapeHtml(implode('.', $this->getPhpVersionArray())); ?>
<?php echo $block->escapeHtml(implode('.', $block->getPhpVersionArray())); ?>
</a>
&nbsp;
<?php switch ($this->phpVersionCheck()) {
<?php switch ($block->phpVersionCheck()) {
case 1:
echo '<img class="compatible-image" height="16" src="' . $this->getViewFileUrl(
echo '<img class="compatible-image" height="16" src="' . $block->getViewFileUrl(
'TIG_GLS::images/green-ok.png'
) . '" alt="">';
break;
case 0:
echo '<img class="compatible-image" height="16" src="' . $this->getViewFileUrl(
echo '<img class="compatible-image" height="16" src="' . $block->getViewFileUrl(
'TIG_GLS::images/red-nok.png'
) . '" alt="">';
break;
default:
echo '<img class="compatible-image" height="16" src="' . $this->getViewFileUrl(
echo '<img class="compatible-image" height="16" src="' . $block->getViewFileUrl(
'TIG_GLS::images/orange-unknown.png'
) . '" alt="">';
break;
Expand All @@ -53,15 +53,18 @@

<div id="section">
<div class="collapse-title" data-role="title">
<h3 data-role="trigger"><?php echo $block->escapeHtml(__('Support'));?></h3>
<h3 data-role="trigger"><?php echo $block->escapeHtml(__('Support')); ?></h3>
</div>
<div class="collapse-content support-gls-tig" data-role="content" style="display:none;">
<?php echo __('This extension is developed by <a href="https://tig.nl" target="_BLANK">TIG</a>');?>
<?php echo $block->escapeHtml(
__('This extension is developed by <a href="https://tig.nl" target="_BLANK">TIG</a>'),
['a']
); ?>

<div class="colset-2">
<div class="col-1">
<h4><?php echo __('Extension basic configuration and account information');?></h4>
<?php echo __('Please contact:'); ?> <a href="mailto:helpdesk@gls-netherlands.com">helpdesk@gls-netherlands.com</a>
<h4><?php echo $block->escapeHtml(__('Extension basic configuration and account information')); ?></h4>
<?php echo $block->escapeHtml(__('Please contact:')); ?> <a href="mailto:helpdesk@gls-netherlands.com">helpdesk@gls-netherlands.com</a>
</div>
<div class="col-2">

Expand Down