name might not be displayed correctly

Change-Id: I949c7a80b5356f393d269d3004bd6800772ac63b Reviewed-on: http://gerrit.tine20.com/customers/5618 Reviewed-by: Cornelius Weiss <c.weiss@metaways.de> Tested-by: Cornelius Weiss <c.weiss@metaways.de>
tine20 · Sep 8, 2017 · bc8a6fb · bc8a6fb
1 parent 2e44e19
commit bc8a6fb
Show file tree

Hide file tree

Showing 14 changed files with 31 additions and 23 deletions.
diff --git a/tine20/Addressbook/js/ContactGrid.js b/tine20/Addressbook/js/ContactGrid.js
@@ -259,12 +259,12 @@ Tine.Addressbook.ContactGridPanel.contactTypeRenderer = function(data, cell, rec
 
 Tine.Addressbook.ContactGridPanel.displayNameRenderer = function(data) {
     var i18n = Tine.Tinebase.appMgr.get('Addressbook').i18n;
-    return data ? data : ('<div class="renderer_displayNameRenderer_noName">' + i18n._('No name') + '</div>');
+    return data ? Ext.util.Format.htmlEncode(data) : ('<div class="renderer_displayNameRenderer_noName">' + i18n._('No name') + '</div>');
 };
 
 Tine.Addressbook.ContactGridPanel.countryRenderer = function(data) {
     data = Locale.getTranslationData('CountryList', data);
-    return data;
+    return Ext.util.Format.htmlEncode(data);
 };
 
 /**

diff --git a/tine20/Felamimail/js/FolderSelectPanel.js b/tine20/Felamimail/js/FolderSelectPanel.js
@@ -123,7 +123,7 @@ Tine.Felamimail.FolderSelectPanel = Ext.extend(Ext.Panel, {
                     allowDrop: false,
                     expanded: false,
                     text: Ext.util.Format.htmlEncode(record.get('name')),
-                    qtip: Tine.Tinebase.common.doubleEncode(record.get('host')),
+                    qtip: Ext.util.Format.htmlEncode(record.get('host')),
                     leaf: false,
                     cls: 'felamimail-node-account',
                     delimiter: record.get('delimiter'),

diff --git a/tine20/Felamimail/js/TreePanel.js b/tine20/Felamimail/js/TreePanel.js
@@ -781,7 +781,7 @@ Ext.extend(Tine.Felamimail.TreePanel, Ext.tree.TreePanel, {
             allowDrop: false,
             expanded: false,
             text: Ext.util.Format.htmlEncode(record.get('name')),
-            qtip: Tine.Tinebase.common.doubleEncode(record.get('host')),
+            qtip: Ext.util.Format.htmlEncode(record.get('host')),
             leaf: false,
             cls: 'felamimail-node-account',
             delimiter: record.get('delimiter'),

diff --git a/tine20/Filemanager/js/NodeTreePanel.js b/tine20/Filemanager/js/NodeTreePanel.js
@@ -253,10 +253,10 @@ Ext.extend(Tine.Filemanager.NodeTreePanel, Tine.widgets.container.TreePanel, {
         if(attr.name && typeof attr.name == 'object') {
             Ext.apply(attr, {
                 text: Ext.util.Format.htmlEncode(attr.name.name),
-                qtip: Tine.Tinebase.common.doubleEncode(attr.name.name)
+                qtip: Ext.util.Format.htmlEncode(attr.name.name)
             });
         }
-        
+
         // copy 'real' data to a node record NOTE: not a full record as we have no record reader here
         var nodeData = Ext.copyTo({}, attr, Tine.Filemanager.Model.Node.getFieldNames());
         attr.nodeRecord = new Tine.Filemanager.Model.Node(nodeData);
@@ -577,13 +577,13 @@ Ext.extend(Tine.Filemanager.NodeTreePanel, Tine.widgets.container.TreePanel, {
         var newNodeRecord = new Tine.Filemanager.Model.Node(nodeData);
 
         var newNode = new Ext.tree.AsyncTreeNode({
-            text: nodeName,
+            text: Ext.util.Format.htmlEncode(nodeName),
             path: nodeData.path,
             name: nodeData.name,
             nodeRecord: newNodeRecord,
             account_grants: nodeData.account_grants,
             id: nodeData.id
-        })
+        });
 
         newNode.attributes.nodeRecord.beginEdit();
         newNode.attributes.nodeRecord.set('path', nodeData.path);

diff --git a/tine20/Phone/js/PhoneTreePanel.js b/tine20/Phone/js/PhoneTreePanel.js
@@ -101,13 +101,13 @@ Tine.Phone.PhoneTreePanel = Ext.extend(Ext.tree.TreePanel, {
         this.store.each(function(record) {
             var label = (record.data.description == '') 
                ? record.data.macaddress 
-               : Ext.util.Format.ellipsis(record.data.description, 30);
+               : Ext.util.Format.ellipsis(Ext.util.Format.htmlEncode(record.data.description), 30);
             var node = new Ext.tree.TreeNode({
                 id: record.id,
                 record: record,
                 text: label,
                 iconCls: 'PhoneIconCls',
-                qtip: Tine.Tinebase.common.doubleEncode(record.data.description),
+                qtip: Ext.util.Format.htmlEncode(record.data.description),
                 leaf: true
             });
             rootNode.appendChild(node);

diff --git a/tine20/Tinebase/js/ux/Percentage.js b/tine20/Tinebase/js/ux/Percentage.js
@@ -192,7 +192,7 @@ Ext.ux.PercentRendererWithName = function(value, metadata, record) {
             metadata.css = 'x-tinebase-uploadrow';
         }
 
-        return fileName;
+        return Ext.util.Format.htmlEncode(fileName);
     }
 
     if (! Ext.ux.PercentRendererWithName.template) {
@@ -221,15 +221,15 @@ Ext.ux.PercentRendererWithName = function(value, metadata, record) {
     if (typeof value == 'object') {
         fileName = value.name;
     }
-
+    fileName = Ext.util.Format.htmlEncode(fileName);
     var percent = record.get('progress');
 
     var additionalStyle = '';
     if(record.get('status') == 'paused' && percent < 100) {
         fileName = _('(paused)') + '&#160;&#160;' + fileName;
         additionalStyle = 'background-image: url(\'styles/images/tine20/progress/progress-bg-y.gif\') !important;';
     }
-       
+
     var display = 'width:0px';
     if(percent > -1 && percent < 100) {
         display = '';

diff --git a/tine20/Tinebase/js/widgets/ActivitiesPanel.js b/tine20/Tinebase/js/widgets/ActivitiesPanel.js
@@ -122,6 +122,8 @@ Tine.widgets.activities.ActivitiesTabPanel = Ext.extend(Ext.Panel, {
         var recordClass = Tine.Tinebase.data.RecordMgr.get(this.record_model),
             app = Tine.Tinebase.appMgr.get(this.app);
 
+        note = Ext.util.Format.htmlEncode(note);
+
         if (recordClass) {
             Ext.each(recordClass.getFieldDefinitions(), function(field) {
                 if (field.label) {

diff --git a/tine20/Tinebase/js/widgets/container/TreePanel.js b/tine20/Tinebase/js/widgets/container/TreePanel.js
@@ -495,12 +495,15 @@ Ext.extend(Tine.widgets.container.TreePanel, Ext.tree.TreePanel, {
         }
 
         Ext.applyIf(attr, {
-            text: Ext.util.Format.htmlEncode(attr.name),
-            qtip: Tine.Tinebase.common.doubleEncode(attr.name),
+            text: attr.name,
+            qtip: attr.name,
             leaf: !!attr.account_grants,
             allowDrop: !!attr.account_grants && attr.account_grants.addGrant
         });
-
+
+        attr.text = Ext.util.Format.htmlEncode(attr.text);
+        attr.qtip = Ext.util.Format.htmlEncode(attr.qtip);
+
         // copy 'real' data to container space
         attr.container = Ext.copyTo({}, attr, Tine.Tinebase.Model.Container.getFieldNames());
     },

diff --git a/tine20/Tinebase/js/widgets/grid/FilterPanel.js b/tine20/Tinebase/js/widgets/grid/FilterPanel.js
@@ -520,7 +520,7 @@ Ext.extend(Tine.widgets.grid.FilterPanel, Ext.Panel, {
 
         for (var id in this.filterPanels) {
             if (this.filterPanels.hasOwnProperty(id) && this.filterPanels[id].isActive) {
-                filters.push({'condition': 'AND', 'filters': this.filterPanels[id].getValue(), 'id': id, label: this.filterPanels[id].title});
+                filters.push({'condition': 'AND', 'filters': this.filterPanels[id].getValue(), 'id': id, label: Ext.util.Format.htmlDecode(this.filterPanels[id].title)});
             }
         }
 

diff --git a/tine20/Tinebase/js/widgets/grid/FilterStructureTreePanel.js b/tine20/Tinebase/js/widgets/grid/FilterStructureTreePanel.js
@@ -82,6 +82,9 @@ Tine.widgets.grid.FilterStructureTreePanel = Ext.extend(Ext.tree.TreePanel, {
         this.filterPanel.activeFilterPanel.on('titlechange', this.onFilterPanelTitleChange, this);
 
         this.editor = new Ext.tree.TreeEditor(this);
+        this.editor.on('startedit', function(el, value) {
+            this.editor.setValue(Ext.util.Format.htmlDecode(value));
+        }, this);
 
         Tine.widgets.grid.FilterStructureTreePanel.superclass.initComponent.call(this);
     },
@@ -113,7 +116,7 @@ Tine.widgets.grid.FilterStructureTreePanel = Ext.extend(Ext.tree.TreePanel, {
      */
     onNodeTextChange: function(node, text, oldText) {
         if (node.attributes && node.attributes.filterPanel) {
-            node.attributes.filterPanel.setTitle(text);
+            node.attributes.filterPanel.setTitle(Ext.util.Format.htmlEncode(text));
         }
     },
 

diff --git a/tine20/Tinebase/js/widgets/persistentfilter/PickerPanel.js b/tine20/Tinebase/js/widgets/persistentfilter/PickerPanel.js
@@ -626,7 +626,7 @@ Tine.widgets.persistentfilter.PickerTreePanelLoader = Ext.extend(Tine.widgets.tr
                     Ext.apply(attr, {
                         isPersistentFilter : isPersistentFilter,
                         text : Ext.util.Format.htmlEncode(this.app.i18n._hidden(attr.name)),
-                        qtip : Tine.Tinebase.common.doubleEncode(attr.description ? this.app.i18n._hidden(attr.description) + ' ' + addText : addText),
+                        qtip : Ext.util.Format.htmlEncode(attr.description ? this.app.i18n._hidden(attr.description) + ' ' + addText : addText),
                         selected : attr.id === this.selectedFilterId,
                         id : attr.id,
 

diff --git a/tine20/Tinebase/js/widgets/relation/GridRenderer.js b/tine20/Tinebase/js/widgets/relation/GridRenderer.js
@@ -60,7 +60,7 @@ Ext.extend(Tine.widgets.relation.GridRenderer, Ext.Component, {
             var el = relations[index];
             if (el.type == this.type && el.related_model == this.relModel) {
                 var record = new this.recordClass(el.related_record);
-                return record.getTitle();
+                return Ext.util.Format.htmlEncode(record.getTitle());
             }
         }
     }

diff --git a/tine20/Tinebase/js/widgets/tree/ContextMenu.js b/tine20/Tinebase/js/widgets/tree/ContextMenu.js
@@ -282,7 +282,7 @@ Tine.widgets.tree.ContextMenu = {
                 title: String.format(_('Rename {0}'), this.nodeName),
                 msg: String.format(_('Please enter the new name of the {0}:'), this.nodeName),
                 buttons: Ext.MessageBox.OKCANCEL,
-                value: node.attributes.longName || node.text,
+                value: Ext.util.Format.htmlDecode(node.attributes.longName || node.text),
                 fn: function(_btn, _text){
                     if (_btn == 'ok') {
                         if (! _text) {
@@ -326,7 +326,7 @@ Tine.widgets.tree.ContextMenu = {
                             success: function(_result, _request){
 
                                 var nodeData = Ext.util.JSON.decode(_result.responseText);
-                                node.setText(_text);
+                                node.setText(Ext.util.Format.htmlEncode(_text));
 
                                 this.scope.fireEvent('containerrename', nodeData, node, _text);
 

diff --git a/tine20/Tinebase/js/widgets/tree/Loader.js b/tine20/Tinebase/js/widgets/tree/Loader.js
@@ -120,7 +120,7 @@ Tine.widgets.tree.Loader = Ext.extend(Ext.tree.TreeLoader, {
             }, this);
 
             node.longName = node.name;
-            node.text = node.name = Ext.util.Format.htmlEncode(containerName);
+            node.text = node.name = containerName;
 
             parentNode.push(node);
         }, this);