From 4f9f86e310a433d56622527be002ba2a474c5240 Mon Sep 17 00:00:00 2001 From: Michael Date: Sun, 25 Nov 2018 18:56:26 +0000 Subject: [PATCH 1/7] We are now escaping many template fields --- src/Module/Contact.php | 10 +-- src/Object/Post.php | 6 +- view/templates/admin/addon_details.tpl | 2 +- view/templates/admin/contactblock.tpl | 4 +- view/templates/admin/users.tpl | 16 ++-- view/templates/hovercard.tpl | 14 ++-- view/templates/profile_vcard.tpl | 6 +- view/templates/vcard-widget.tpl | 10 +-- view/templates/wall_thread.tpl | 8 +- view/templates/widget_forumlist.tpl | 8 +- .../duepuntozero/templates/profile_vcard.tpl | 4 +- view/theme/frio/templates/admin/addons.tpl | 2 +- .../frio/templates/admin/contactblock.tpl | 8 +- view/theme/frio/templates/admin/queue.tpl | 12 +-- view/theme/frio/templates/admin/summary.tpl | 6 +- view/theme/frio/templates/admin/users.tpl | 24 +++--- view/theme/frio/templates/comment_item.tpl | 14 ++-- view/theme/frio/templates/common_tabs.tpl | 6 +- view/theme/frio/templates/contact_edit.tpl | 76 ++++++++--------- .../theme/frio/templates/contact_template.tpl | 40 ++++----- view/theme/frio/templates/credits.tpl | 4 +- view/theme/frio/templates/crepair.tpl | 2 +- view/theme/frio/templates/event.tpl | 10 +-- .../frio/templates/event_stream_item.tpl | 8 +- view/theme/frio/templates/events_js.tpl | 8 +- view/theme/frio/templates/filebrowser.tpl | 10 +-- view/theme/frio/templates/intros.tpl | 4 +- view/theme/frio/templates/jot.tpl | 2 +- view/theme/frio/templates/like_noshare.tpl | 2 +- view/theme/frio/templates/mail_conv.tpl | 4 +- view/theme/frio/templates/mail_list.tpl | 2 +- view/theme/frio/templates/nav.tpl | 84 +++++++++---------- view/theme/frio/templates/photo_item.tpl | 2 +- view/theme/frio/templates/photo_top.tpl | 2 +- view/theme/frio/templates/photo_view.tpl | 4 +- view/theme/frio/templates/profile_entry.tpl | 2 +- view/theme/frio/templates/profile_vcard.tpl | 46 +++++----- view/theme/frio/templates/search_item.tpl | 64 +++++++------- view/theme/frio/templates/vcard-widget.tpl | 10 +-- view/theme/frio/templates/wall_thread.tpl | 76 ++++++++--------- .../quattro/templates/contact_template.tpl | 8 +- view/theme/quattro/templates/events.tpl | 6 +- view/theme/quattro/templates/mail_conv.tpl | 18 ++-- .../theme/quattro/templates/profile_vcard.tpl | 8 +- view/theme/quattro/templates/search_item.tpl | 34 ++++---- .../theme/quattro/templates/wall_item_tag.tpl | 8 +- view/theme/quattro/templates/wall_thread.tpl | 10 +-- .../quattro/templates/widget_forumlist.tpl | 4 +- view/theme/vier/templates/ch_connectors.tpl | 2 +- .../vier/templates/ch_directory_item.tpl | 2 +- view/theme/vier/templates/comment_item.tpl | 16 ++-- .../theme/vier/templates/contact_template.tpl | 6 +- view/theme/vier/templates/nav.tpl | 48 +++++------ view/theme/vier/templates/photo_item.tpl | 30 +++---- view/theme/vier/templates/photo_view.tpl | 4 +- view/theme/vier/templates/profile_vcard.tpl | 6 +- view/theme/vier/templates/search_item.tpl | 36 ++++---- view/theme/vier/templates/wall_item_tag.tpl | 8 +- view/theme/vier/templates/wall_thread.tpl | 60 ++++++------- .../vier/templates/widget_forumlist_right.tpl | 12 +-- 60 files changed, 472 insertions(+), 476 deletions(-) diff --git a/src/Module/Contact.php b/src/Module/Contact.php index ec7e89692..66e8c97fd 100644 --- a/src/Module/Contact.php +++ b/src/Module/Contact.php @@ -85,7 +85,7 @@ class Contact extends BaseModule /// @TODO Add nice spaces $vcard_widget = Renderer::replaceMacros(Renderer::getMarkupTemplate('vcard-widget.tpl'), [ - '$name' => htmlentities($contact['name']), + '$name' => $contact['name'], '$photo' => $contact['photo'], '$url' => Model\Contact::MagicLink($contact['url']), '$addr' => defaults($contact, 'addr', ''), @@ -639,7 +639,7 @@ class Contact extends BaseModule '$ffi_keyword_blacklist' => $contact['ffi_keyword_blacklist'], '$ffi_keyword_blacklist' => ['ffi_keyword_blacklist', L10n::t('Blacklisted keywords'), $contact['ffi_keyword_blacklist'], L10n::t('Comma separated list of keywords that should not be converted to hashtags, when "Fetch information and keywords" is selected')], '$photo' => $contact['photo'], - '$name' => htmlentities($contact['name']), + '$name' => $contact['name'], '$dir_icon' => $dir_icon, '$sparkle' => $sparkle, '$url' => $url, @@ -1033,14 +1033,14 @@ class Contact extends BaseModule 'alt_text' => $alt_text, 'dir_icon' => $dir_icon, 'thumb' => ProxyUtils::proxifyUrl($rr['thumb'], false, ProxyUtils::SIZE_THUMB), - 'name' => htmlentities($rr['name']), - 'username' => htmlentities($rr['name']), + 'name' => $rr['name'], + 'username' => $rr['name'], 'account_type' => Model\Contact::getAccountType($rr), 'sparkle' => $sparkle, 'itemurl' => defaults($rr, 'addr', $rr['url']), 'url' => $url, 'network' => ContactSelector::networkToName($rr['network'], $rr['url']), - 'nick' => htmlentities($rr['nick']), + 'nick' => $rr['nick'], ]; } diff --git a/src/Object/Post.php b/src/Object/Post.php index e7a9e6b02..50d903f02 100644 --- a/src/Object/Post.php +++ b/src/Object/Post.php @@ -213,7 +213,7 @@ class Post extends BaseObject $filer = (($conv->getProfileOwner() == local_user() && ($item['uid'] != 0)) ? L10n::t("save to folder") : false); - $profile_name = htmlentities($item['author-name']); + $profile_name = $item['author-name']; if (!empty($item['author-link']) && empty($item['author-name'])) { $profile_name = $item['author-link']; } @@ -377,7 +377,7 @@ class Post extends BaseObject 'isevent' => $isevent, 'attend' => $attend, 'linktitle' => L10n::t('View %s\'s profile @ %s', $profile_name, $item['author-link']), - 'olinktitle' => L10n::t('View %s\'s profile @ %s', htmlentities($this->getOwnerName()), $item['owner-link']), + 'olinktitle' => L10n::t('View %s\'s profile @ %s', $this->getOwnerName(), $item['owner-link']), 'to' => L10n::t('to'), 'via' => L10n::t('via'), 'wall' => L10n::t('Wall-to-Wall'), @@ -399,7 +399,7 @@ class Post extends BaseObject 'shiny' => $shiny, 'owner_url' => $this->getOwnerUrl(), 'owner_photo' => $a->removeBaseURL(ProxyUtils::proxifyUrl($item['owner-avatar'], false, ProxyUtils::SIZE_THUMB)), - 'owner_name' => htmlentities($owner_name_e), + 'owner_name' => $owner_name_e, 'plink' => Item::getPlink($item), 'edpost' => $edpost, 'isstarred' => $isstarred, diff --git a/view/templates/admin/addon_details.tpl b/view/templates/admin/addon_details.tpl index fb908b705..96b26d2d0 100644 --- a/view/templates/admin/addon_details.tpl +++ b/view/templates/admin/addon_details.tpl @@ -18,7 +18,7 @@

{{if $screenshot}} - {{$screenshot.1}} + {{$screenshot.1|escape}} {{/if}} {{if $admin_form}} diff --git a/view/templates/admin/contactblock.tpl b/view/templates/admin/contactblock.tpl index 152550f01..c9bfc2efd 100644 --- a/view/templates/admin/contactblock.tpl +++ b/view/templates/admin/contactblock.tpl @@ -32,10 +32,10 @@ {{foreach $contacts as $contact}} - {{$contact.nickname}} + {{$contact.nickname|escape}} {{$contact.name}} {{$contact.addr}} - {{$contact.url}} + {{$contact.url}} {{/foreach}} diff --git a/view/templates/admin/users.tpl b/view/templates/admin/users.tpl index b2b0d615a..f06b0f973 100644 --- a/view/templates/admin/users.tpl +++ b/view/templates/admin/users.tpl @@ -35,8 +35,8 @@ {{$u.email}} - - + + @@ -79,8 +79,8 @@ {{foreach $users as $u}} - {{$u.nickname}} - {{$u.name}} + {{$u.nickname|escape}} + {{$u.name}} {{$u.email}} {{$u.register_date}} {{$u.login_date}} @@ -94,8 +94,8 @@ {{/if}} {{if $u.is_deletable}} - - + + {{else}}   {{/if}} @@ -122,8 +122,8 @@ {{foreach $deleted as $u}} - {{$u.nickname}} - {{$u.name}} + {{$u.nickname|escape}} + {{$u.name}} {{$u.email}} {{$u.register_date}} {{$u.login_date}} diff --git a/view/templates/hovercard.tpl b/view/templates/hovercard.tpl index 7bf37e74b..74f270005 100644 --- a/view/templates/hovercard.tpl +++ b/view/templates/hovercard.tpl @@ -3,12 +3,12 @@
- {{$profile.name}} + {{$profile.name|escape}}
-

{{$profile.name}}

{{if $profile.account_type}}{{$profile.account_type}}{{/if}} +

{{$profile.name|escape}}

{{if $profile.account_type}}{{$profile.account_type}}{{/if}}
{{$profile.addr}} @@ -21,13 +21,13 @@ {{* here are the differnt actions like privat message, poke, delete and so on *}} {{* @todo we have two different photo menus one for contacts and one for items at the network stream. We currently use the contact photo menu, so the items options are missing We need to move them *}}
- {{if $profile.actions.pm}}{{/if}} - {{if $profile.actions.poke}}{{/if}} + {{if $profile.actions.pm}}{{/if}} + {{if $profile.actions.poke}}{{/if}}
- {{if $profile.actions.network}}{{/if}} - {{if $profile.actions.edit}}{{/if}} - {{if $profile.actions.follow}}{{/if}} + {{if $profile.actions.network}}{{/if}} + {{if $profile.actions.edit}}{{/if}} + {{if $profile.actions.follow}}{{/if}}
diff --git a/view/templates/profile_vcard.tpl b/view/templates/profile_vcard.tpl index b56dd607c..6f8e86b29 100644 --- a/view/templates/profile_vcard.tpl +++ b/view/templates/profile_vcard.tpl @@ -1,16 +1,16 @@
-
{{$profile.name}}
+
{{$profile.name|escape}}
{{if $profile.addr}}
{{$profile.addr}}
{{/if}} {{if $profile.pdesc}}
{{$profile.pdesc}}
{{/if}} {{if $profile.picdate}} -
{{$profile.name}}
+
{{$profile.name|escape}}
{{else}} -
{{$profile.name}}
+
{{$profile.name|escape}}
{{/if}} {{if $account_type}}{{/if}} {{if $profile.network_name}}
{{$network}}
{{$profile.network_name}}
{{/if}} diff --git a/view/templates/vcard-widget.tpl b/view/templates/vcard-widget.tpl index 47b64b68d..eed94193f 100644 --- a/view/templates/vcard-widget.tpl +++ b/view/templates/vcard-widget.tpl @@ -1,14 +1,14 @@
-
{{$name}}
- {{if $addr}}
{{$addr}}
{{/if}} +
{{$name|escape}}
+ {{if $addr}}
{{$addr|escape}}
{{/if}} {{if $pdesc}}
{{$pdesc}}
{{/if}} {{if $url}} -
{{$name}}
+
{{$name|escape}}
{{else}} -
{{$name}}
+
{{$name|escape}}
{{/if}} - {{if $account_type}}{{/if}} + {{if $account_type}}{{/if}} {{if $network_name}}
{{$network}}
{{$network_name}}
{{/if}}
diff --git a/view/templates/wall_thread.tpl b/view/templates/wall_thread.tpl index a82efa7d1..63a8364f8 100644 --- a/view/templates/wall_thread.tpl +++ b/view/templates/wall_thread.tpl @@ -19,15 +19,15 @@ {{if $item.owner_url}}
- {{$item.owner_name}} + {{$item.owner_name|escape}}
-
{{$item.wall}}
+
{{$item.wall|escape}}
{{/if}}
- {{$item.name}} + {{$item.name|escape}} menu
    @@ -38,7 +38,7 @@
- {{if $item.lock}}
{{$item.lock}}
+ {{if $item.lock}}
{{$item.lock|escape}}
{{else}}
{{/if}}
{{$item.location}}
diff --git a/view/templates/widget_forumlist.tpl b/view/templates/widget_forumlist.tpl index 32da71f81..da30967cd 100644 --- a/view/templates/widget_forumlist.tpl +++ b/view/templates/widget_forumlist.tpl @@ -21,8 +21,8 @@ function showHideForumlist() { {{if $forum.id <= $visible_forums}} @@ -31,8 +31,8 @@ function showHideForumlist() { {{if $forum.id > $visible_forums}} diff --git a/view/theme/duepuntozero/templates/profile_vcard.tpl b/view/theme/duepuntozero/templates/profile_vcard.tpl index 186b7e449..505cf560e 100644 --- a/view/theme/duepuntozero/templates/profile_vcard.tpl +++ b/view/theme/duepuntozero/templates/profile_vcard.tpl @@ -1,12 +1,12 @@
-
{{$profile.name}}
+
{{$profile.name|escape}}
{{if $profile.addr}}
{{$profile.addr}}
{{/if}} {{if $profile.pdesc}}
{{$profile.pdesc}}
{{/if}} -
{{$profile.name}}
+
{{$profile.name|escape}}
{{if $account_type}}{{/if}} diff --git a/view/theme/frio/templates/admin/addons.tpl b/view/theme/frio/templates/admin/addons.tpl index 220abdc2c..38efb62bd 100644 --- a/view/theme/frio/templates/admin/addons.tpl +++ b/view/theme/frio/templates/admin/addons.tpl @@ -12,7 +12,7 @@
  • - {{$p.2.name}} - {{$p.2.version}} + {{$p.2.name|escape}} - {{$p.2.version}} {{if $p.2.experimental}} {{$experimental}} {{/if}}{{if $p.2.unsupported}} {{$unsupported}} {{/if}}
    {{$p.2.description}}
    • diff --git a/view/theme/frio/templates/admin/contactblock.tpl b/view/theme/frio/templates/admin/contactblock.tpl index 3173c238b..3ac9a2517 100644 --- a/view/theme/frio/templates/admin/contactblock.tpl +++ b/view/theme/frio/templates/admin/contactblock.tpl @@ -67,9 +67,9 @@
    - {{$contact.nickname}} - {{$contact.name}} - {{$contact.url}} + {{$contact.nickname|escape}} + {{$contact.name|escape}} + {{$contact.url|escape}} {{/foreach}} @@ -78,7 +78,7 @@ {{* Checkbox to select all blocked contacts *}}
    - +
    diff --git a/view/theme/frio/templates/admin/queue.tpl b/view/theme/frio/templates/admin/queue.tpl index dde386399..3ebe89052 100644 --- a/view/theme/frio/templates/admin/queue.tpl +++ b/view/theme/frio/templates/admin/queue.tpl @@ -13,12 +13,12 @@ {{foreach $entries as $e}} - {{$e.id}} - {{$e.name}} - {{$e.nurl}} - {{$e.network}} - {{$e.created}} - {{$e.last}} + {{$e.id|escape}} + {{$e.name|escape}} + {{$e.nurl|escape}} + {{$e.network|escape}} + {{$e.created|escape}} + {{$e.last|escape}} {{/foreach}} diff --git a/view/theme/frio/templates/admin/summary.tpl b/view/theme/frio/templates/admin/summary.tpl index 66afda721..c2bbf49a7 100644 --- a/view/theme/frio/templates/admin/summary.tpl +++ b/view/theme/frio/templates/admin/summary.tpl @@ -54,14 +54,14 @@ {{* The Friendica version. *}}
    -
    {{$version.0}}
    -
    {{$platform}} '{{$codename}}' {{$version.1}} - {{$build}}
    +
    {{$version.0|escape}}
    +
    {{$platform}} '{{$codename|escape}}' {{$version.1|escape}} - {{$build|escape}}
    {{* Server Settings. *}}
    -
    {{$serversettings.label}}
    +
    {{$serversettings.label|escape}}
    diff --git a/view/theme/frio/templates/admin/users.tpl b/view/theme/frio/templates/admin/users.tpl index 92ef9be6f..031ffd0a4 100644 --- a/view/theme/frio/templates/admin/users.tpl +++ b/view/theme/frio/templates/admin/users.tpl @@ -46,11 +46,11 @@ - + {{if $u.note}} @@ -145,8 +145,8 @@   {{/if}} - - + + {{if $order_users == $th_users.2.1}} @@ -169,18 +169,18 @@ {{if $u.page_flags_raw==3}}fa-heart{{/if}} {{* PAGE_FREELOVE *}} {{if $u.page_flags_raw==4}}fa-rss{{/if}} {{* PAGE_BLOG *}} {{if $u.page_flags_raw==5}}fa-user-secret{{/if}} {{* PAGE_PRVGROUP *}} - " title="{{$u.page_flags}}"> + " title="{{$u.page_flags|escape}}"> {{if $u.page_flags_raw==0 && $u.account_type_raw > 0}} {{/if}} - {{if $u.is_admin}}{{/if}} - {{if $u.account_expired}}{{/if}} + {{if $u.is_admin}}{{/if}} + {{if $u.account_expired}}{{/if}} {{/if}} @@ -229,7 +229,7 @@ {{/if}} - + {{else}} @@ -297,8 +297,8 @@ {{foreach $deleted as $u}} - - + + diff --git a/view/theme/frio/templates/comment_item.tpl b/view/theme/frio/templates/comment_item.tpl index 4ef5f2caa..804d07ac0 100644 --- a/view/theme/frio/templates/comment_item.tpl +++ b/view/theme/frio/templates/comment_item.tpl @@ -33,37 +33,37 @@ {{/if}}
    • -
    • -
    • -
    • -
    • -
    • -
    • -
      • diff --git a/view/theme/frio/templates/common_tabs.tpl b/view/theme/frio/templates/common_tabs.tpl index 76c6db039..207ffefcb 100644 --- a/view/theme/frio/templates/common_tabs.tpl +++ b/view/theme/frio/templates/common_tabs.tpl @@ -6,7 +6,7 @@
      • @@ -31,7 +31,7 @@ @@ -35,35 +35,35 @@
      - {{$contact_status}} + {{$contact_status|escape}} {{* Block with status information about the contact *}}
        - {{if $relation_text}}
      • {{$relation_text}}
        • {{/if}} - {{if $nettype}}
      • {{$nettype}}
        • {{/if}} + {{if $relation_text}}
      • {{$relation_text|escape}}
        • {{/if}} + {{if $nettype}}
      • {{$nettype|escape}}
        • {{/if}} {{if $poll_enabled}} -
      • {{$lastupdtext}} {{$last_update}}
        +
      • {{$lastupdtext|escape}} {{$last_update|escape}}
        {{if $poll_interval}}
        - {{$updpub}} {{$poll_interval}} + {{$updpub|escape}} {{$poll_interval}} {{/if}}
        • {{/if}} - {{if $lost_contact}}
      • {{$lost_contact}}
        • {{/if}} - {{if $insecure}}
      • {{$insecure}}
        • {{/if}} - {{if $blocked && !$pending}}
      • {{$blocked}}
        • {{/if}} - {{if $pending}}
      • {{$pending}}
        • {{/if}} - {{if $ignored}}
      • {{$ignored}}
        • {{/if}} - {{if $archived}}
      • {{$archived}}
        • {{/if}} + {{if $lost_contact}}
      • {{$lost_contact|escape}}
        • {{/if}} + {{if $insecure}}
      • {{$insecure|escape}}
        • {{/if}} + {{if $blocked && !$pending}}
      • {{$blocked|escape}}
        • {{/if}} + {{if $pending}}
      • {{$pending|escape}}
        • {{/if}} + {{if $ignored}}
      • {{$ignored|escape}}
        • {{/if}} + {{if $archived}}
      • {{$archived|escape}}
        • {{/if}}
      {{* End of contact-edit-status-wrapper *}} @@ -83,38 +83,38 @@
      -
      {{$profileurllabel}}
      {{$profileurl}} +
      {{$profileurllabel|escape}}
      {{$profileurl|escape}}
      {{if $location}}
      -
      {{$location_label}}
      -
      {{$location}}
      +
      {{$location_label|escape}}
      +
      {{$location|escape}}
      {{/if}} {{if $xmpp}}
      -
      {{$xmpp_label}}
      -
      {{$xmpp}}
      +
      {{$xmpp_label|escape}}
      +
      {{$xmpp|escape}}
      {{/if}} {{if $keywords}}
      -
      {{$keywords_label}}
      -
      {{$keywords}}
      +
      {{$keywords_label|escape}}
      +
      {{$keywords|escape}}
      {{/if}} {{if $about}}
      -
      {{$about_label}}
      -
      {{$about}}
      +
      {{$about_label|escape}}
      +
      {{$about|escape}}
      {{/if}}
      @@ -127,14 +127,14 @@
      - + {{include file="field_checkbox.tpl" field=$notify}} {{if $fetch_further_information}} @@ -144,7 +144,7 @@ {{include file="field_checkbox.tpl" field=$hidden}}
      - +
      @@ -157,7 +157,7 @@ @@ -167,11 +167,11 @@ {{include file="field_textarea.tpl" field=$cinfo}}
      - +
      {{if $reason}} -

      {{$lbl_info2}}

      +

      {{$lbl_info2|escape}}

      {{$reason}}

      {{/if}} @@ -184,7 +184,7 @@ @@ -192,7 +192,7 @@
      {{if $profile_select}}
      -

      {{$lbl_vis2}}

      +

      {{$lbl_vis2|escape}}

      {{$profile_select}} @@ -201,7 +201,7 @@ {{/if}}
      - +
      diff --git a/view/theme/frio/templates/contact_template.tpl b/view/theme/frio/templates/contact_template.tpl index e1c0a7700..4f07ad2b1 100644 --- a/view/theme/frio/templates/contact_template.tpl +++ b/view/theme/frio/templates/contact_template.tpl @@ -6,14 +6,14 @@
      {{* For very small displays we use a drobdown menu for contact relating actions *}} {{/if}} {{if $contact.photo_menu.poke}} - {{/if}} {{if $contact.photo_menu.network}} - + {{/if}} {{if $contact.photo_menu.edit}} - + {{/if}} {{if $contact.photo_menu.drop}} - {{/if}} {{if $contact.photo_menu.follow}} - + {{/if}} {{if $contact.photo_menu.hide}} - + {{/if}} @@ -84,7 +84,7 @@ {{* The button to add or remove contacts from a contact group - group edit page *}} {{if $contact.change_member}}
      - {/if} {if $photo_menu.poke} - {/if} {if $photo_menu.network} - + {/if} {if $photo_menu.edit} - + {/if} {if $photo_menu.drop} - + {/if} {if $photo_menu.follow} - + {/if} @@ -207,7 +207,7 @@ We use this part to filter the contacts with jquery.textcomplete *}} {{* The button to add or remove contacts from a contact group - group edit page *}} {if $contact.change_member}
      - {{/if}} - {{if $event.copy}}{{/if}} - {{if $event.drop}}{{/if}} - {{if $event.item.plink}}{{/if}} + {{if $event.edit}}{{/if}} + {{if $event.copy}}{{/if}} + {{if $event.drop}}{{/if}} + {{if $event.item.plink}}{{/if}}
      diff --git a/view/theme/frio/templates/event_stream_item.tpl b/view/theme/frio/templates/event_stream_item.tpl index 87c2e70ca..58f39a0ee 100644 --- a/view/theme/frio/templates/event_stream_item.tpl +++ b/view/theme/frio/templates/event_stream_item.tpl @@ -17,16 +17,16 @@ {{if $location.map}}{{/if}}
      - {{$start_short}} - {{if $finish}} - {{if $same_date}}{{$end_time}}{{else}}{{$end_short}}{{/if}}{{/if}} + {{$start_short}} + {{if $finish}} - {{if $same_date}}{{$end_time}}{{else}}{{$end_short}}{{/if}}{{/if}} {{if $location.name}} - {{$location.name}} + {{$location.name|escape}} {{/if}}
      - {{$author_name}} + {{$author_name|escape}}
      {{if $location.map}}
      {{$location.map}}
      diff --git a/view/theme/frio/templates/events_js.tpl b/view/theme/frio/templates/events_js.tpl index a4ca9004c..3866282a3 100644 --- a/view/theme/frio/templates/events_js.tpl +++ b/view/theme/frio/templates/events_js.tpl @@ -5,7 +5,7 @@ {{* The link to create a new event *}} {{if $new_event.0}} @@ -40,9 +40,9 @@ {{* The buttons to change the month/weeks/days *}}
      - - - + + +
      {{* The title (e.g. name of the mont/week/day) *}} diff --git a/view/theme/frio/templates/filebrowser.tpl b/view/theme/frio/templates/filebrowser.tpl index d452810c8..ce58ef0b9 100644 --- a/view/theme/frio/templates/filebrowser.tpl +++ b/view/theme/frio/templates/filebrowser.tpl @@ -9,8 +9,8 @@
      - - + + -

      {{$fullname}}

      +

      {{$fullname|escape}}

      {{$str_notifytype}} {{$notify_type}}
      {{* if the contact was suggestested by another contact, the contact who made the suggestion is displayed*}} {{if $madeby}}
      {{$lbl_madeby}} {{$madeby}}
      {{/if}} @@ -51,7 +51,7 @@ a bootstrap modal in the case of approval *}} diff --git a/view/theme/frio/templates/mail_conv.tpl b/view/theme/frio/templates/mail_conv.tpl index 2ad989849..b5154aa4c 100644 --- a/view/theme/frio/templates/mail_conv.tpl +++ b/view/theme/frio/templates/mail_conv.tpl @@ -2,13 +2,13 @@
      - {{$mail.from_name}} + {{$mail.from_name|escape}}
      {{$mail.date}}
      -

      {{$mail.from_name}}

      +

      {{$mail.from_name|escape}}

      {{$mail.body}} diff --git a/view/theme/frio/templates/mail_list.tpl b/view/theme/frio/templates/mail_list.tpl index 4a797d47c..225fd71c1 100644 --- a/view/theme/frio/templates/mail_list.tpl +++ b/view/theme/frio/templates/mail_list.tpl @@ -5,7 +5,7 @@
      - {{$from_name}} + {{$from_name|escape}}
      diff --git a/view/theme/frio/templates/nav.tpl b/view/theme/frio/templates/nav.tpl index d64eae9c4..6f20c247c 100644 --- a/view/theme/frio/templates/nav.tpl +++ b/view/theme/frio/templates/nav.tpl @@ -40,37 +40,37 @@
    - - + + {{/foreach}} diff --git a/view/templates/hovercard.tpl b/view/templates/hovercard.tpl index 74f270005..5487a4cd0 100644 --- a/view/templates/hovercard.tpl +++ b/view/templates/hovercard.tpl @@ -11,7 +11,7 @@

    {{$profile.name|escape}}

    {{if $profile.account_type}}{{$profile.account_type}}{{/if}}
    - {{$profile.addr}} + {{$profile.addr|escaped}} {{if $profile.network}} ({{$profile.network}}){{/if}}
    {{*{{if $profile.about}}
    {{$profile.about}}
    {{/if}}*}} diff --git a/view/templates/profile_vcard.tpl b/view/templates/profile_vcard.tpl index 6f8e86b29..fb7875641 100644 --- a/view/templates/profile_vcard.tpl +++ b/view/templates/profile_vcard.tpl @@ -3,7 +3,7 @@
    {{$profile.name|escape}}
    - {{if $profile.addr}}
    {{$profile.addr}}
    {{/if}} + {{if $profile.addr}}
    {{$profile.addr|escaped}}
    {{/if}} {{if $profile.pdesc}}
    {{$profile.pdesc}}
    {{/if}} diff --git a/view/templates/remote_friends_common.tpl b/view/templates/remote_friends_common.tpl index 354c8e46a..f018727c0 100644 --- a/view/templates/remote_friends_common.tpl +++ b/view/templates/remote_friends_common.tpl @@ -6,12 +6,12 @@
    - {{$item.name}} + {{$item.name|escaped}}
    - {{$item.name}} + {{$item.name|escaped}}
    diff --git a/view/templates/search_item.tpl b/view/templates/search_item.tpl index fbcf770f1..462624957 100644 --- a/view/templates/search_item.tpl +++ b/view/templates/search_item.tpl @@ -7,7 +7,7 @@ onmouseover="if (typeof t{{$item.id}} != 'undefined') clearTimeout(t{{$item.id}}); openMenu('wall-item-photo-menu-button-{{$item.id}}')" onmouseout="t{{$item.id}}=setTimeout('closeMenu(\'wall-item-photo-menu-button-{{$item.id}}\'); closeMenu(\'wall-item-photo-menu-{{$item.id}}\');',200)"> - {{$item.name}} + {{$item.name|escaped}}menu
      @@ -23,7 +23,7 @@
    - {{$item.name}} + {{$item.name|escaped}}
    {{$item.ago}}
    diff --git a/view/templates/wall_thread.tpl b/view/templates/wall_thread.tpl index 63a8364f8..113a93e8c 100644 --- a/view/templates/wall_thread.tpl +++ b/view/templates/wall_thread.tpl @@ -44,7 +44,7 @@
    - {{$item.name}}{{if $item.owner_url}} {{$item.to}} {{$item.owner_name}} {{$item.vwall}}{{/if}}
    + {{$item.name|escaped}}{{if $item.owner_url}} {{$item.to}} {{$item.owner_name|escaped}} {{$item.vwall}}{{/if}}
    diff --git a/view/theme/duepuntozero/templates/profile_vcard.tpl b/view/theme/duepuntozero/templates/profile_vcard.tpl index 505cf560e..311132b81 100644 --- a/view/theme/duepuntozero/templates/profile_vcard.tpl +++ b/view/theme/duepuntozero/templates/profile_vcard.tpl @@ -3,7 +3,7 @@
    {{$profile.name|escape}}
    - {{if $profile.addr}}
    {{$profile.addr}}
    {{/if}} + {{if $profile.addr}}
    {{$profile.addr|escaped}}
    {{/if}} {{if $profile.pdesc}}
    {{$profile.pdesc}}
    {{/if}}
    {{$profile.name|escape}}
    diff --git a/view/theme/quattro/templates/profile_vcard.tpl b/view/theme/quattro/templates/profile_vcard.tpl index f999f1f57..e62da464d 100644 --- a/view/theme/quattro/templates/profile_vcard.tpl +++ b/view/theme/quattro/templates/profile_vcard.tpl @@ -26,7 +26,7 @@ {{/if}}
    - {{if $profile.addr}}
    {{$profile.addr}}
    {{/if}} + {{if $profile.addr}}
    {{$profile.addr|escaped}}
    {{/if}} {{if $pdesc}}
    {{$profile.pdesc}}
    {{/if}}
    {{$profile.name|escape}}
    diff --git a/view/theme/smoothly/templates/search_item.tpl b/view/theme/smoothly/templates/search_item.tpl index d441ebe2d..35820088b 100644 --- a/view/theme/smoothly/templates/search_item.tpl +++ b/view/theme/smoothly/templates/search_item.tpl @@ -6,7 +6,7 @@ onmouseover="if (typeof t{{$item.id}} != 'undefined') clearTimeout(t{{$item.id}}); openMenu('wall-item-photo-menu-button-{{$item.id}}')" onmouseout="t{{$item.id}}=setTimeout('closeMenu(\'wall-item-photo-menu-button-{{$item.id}}\'); closeMenu(\'wall-item-photo-menu-{{$item.id}}\');',200)"> - {{$item.name}} + {{$item.name|escaped}}menu
      @@ -34,7 +34,7 @@
      {{$item.body}}
    - {{$item.name}} + {{$item.name|escaped}}
    {{$item.ago}}
    diff --git a/view/theme/smoothly/templates/wall_thread.tpl b/view/theme/smoothly/templates/wall_thread.tpl index 5aaa9c4eb..f4c4154a0 100644 --- a/view/theme/smoothly/templates/wall_thread.tpl +++ b/view/theme/smoothly/templates/wall_thread.tpl @@ -15,7 +15,7 @@ {{if $item.owner_url}}
    - {{$item.owner_name}} + {{$item.owner_name|escaped}}
    {{$item.wall}}
    {{/if}} @@ -23,7 +23,7 @@ onmouseover="if (typeof t{{$item.id}} != 'undefined') clearTimeout(t{{$item.id}}); openMenu('wall-item-photo-menu-button-{{$item.id}}')" onmouseout="t{{$item.id}}=setTimeout('closeMenu(\'wall-item-photo-menu-button-{{$item.id}}\'); closeMenu(\'wall-item-photo-menu-{{$item.id}}\');',200)"> - {{$item.name}} + {{$item.name|escaped}}menu
      @@ -47,7 +47,7 @@
      - {{$item.name}} + {{$item.name|escaped}}
      •
      diff --git a/view/theme/vier/templates/profile_vcard.tpl b/view/theme/vier/templates/profile_vcard.tpl index 6ba3119ca..1733969aa 100644 --- a/view/theme/vier/templates/profile_vcard.tpl +++ b/view/theme/vier/templates/profile_vcard.tpl @@ -13,7 +13,7 @@ {{/if}}
      - {{if $profile.addr}}
      {{$profile.addr}}
      {{/if}} + {{if $profile.addr}}
      {{$profile.addr|escaped}}
      {{/if}} {{if $profile.pdesc}}
      {{$profile.pdesc}}
      {{/if}} From 6075245b840a28e8c2d8976ddd624e59d3d2a81f Mon Sep 17 00:00:00 2001 From: Michael Date: Sun, 25 Nov 2018 20:34:02 +0000 Subject: [PATCH 5/7] Much more escapes --- view/templates/admin/site.tpl | 6 +++--- view/templates/birthdays_reminder.tpl | 4 ++-- view/templates/event_stream_item.tpl | 6 +++--- view/templates/events_reminder.tpl | 4 ++-- view/templates/files.tpl | 4 ++-- view/templates/photo_album.tpl | 4 ++-- view/templates/photo_top.tpl | 8 +++----- view/templates/photo_view.tpl | 2 +- view/templates/search_item.tpl | 8 ++++---- view/templates/settings/display.tpl | 2 +- view/templates/wall_thread.tpl | 2 +- view/theme/frio/templates/admin/site.tpl | 6 +++--- view/theme/frio/templates/photo_top.tpl | 2 +- view/theme/frio/templates/photo_view.tpl | 10 +++++----- view/theme/frio/templates/search_item.tpl | 4 ++-- view/theme/frio/templates/settings/display.tpl | 2 +- view/theme/frio/templates/theme_settings.tpl | 2 +- view/theme/frio/templates/wall_thread.tpl | 2 +- view/theme/quattro/templates/photo_item.tpl | 4 ++-- view/theme/quattro/templates/photo_view.tpl | 2 +- view/theme/quattro/templates/search_item.tpl | 4 ++-- view/theme/quattro/templates/wall_thread.tpl | 12 ++++++------ view/theme/smoothly/templates/search_item.tpl | 8 ++++---- view/theme/smoothly/templates/wall_thread.tpl | 10 +++++----- view/theme/vier/templates/communityhome.tpl | 6 +++--- view/theme/vier/templates/wall_thread.tpl | 4 ++-- 26 files changed, 63 insertions(+), 65 deletions(-) diff --git a/view/templates/admin/site.tpl b/view/templates/admin/site.tpl index bf1d215ec..34b1e3b1b 100644 --- a/view/templates/admin/site.tpl +++ b/view/templates/admin/site.tpl @@ -39,7 +39,7 @@ });
      -

      {{$title}} - {{$page}}

      +

      {{$title|escape}} - {{$page|escape}}

      @@ -145,7 +145,7 @@ {{include file="field_input.tpl" field=$dbclean_expire_conv}}
      -

      {{$worker_title}}

      +

      {{$worker_title|escape}}

      {{include file="field_input.tpl" field=$maxloadavg}} {{include file="field_input.tpl" field=$min_memory}} {{include file="field_input.tpl" field=$worker_queues}} @@ -155,7 +155,7 @@
      -

      {{$relay_title}}

      +

      {{$relay_title|escape}}

      {{include file="field_checkbox.tpl" field=$relay_subscribe}} {{include file="field_input.tpl" field=$relay_server}} {{include file="field_checkbox.tpl" field=$relay_directly}} diff --git a/view/templates/birthdays_reminder.tpl b/view/templates/birthdays_reminder.tpl index 6aa51d470..9261ff8d3 100644 --- a/view/templates/birthdays_reminder.tpl +++ b/view/templates/birthdays_reminder.tpl @@ -1,10 +1,10 @@ {{if $count}} -
    - - + + {{/foreach}} diff --git a/view/templates/hovercard.tpl b/view/templates/hovercard.tpl index 5487a4cd0..ec87591b9 100644 --- a/view/templates/hovercard.tpl +++ b/view/templates/hovercard.tpl @@ -11,7 +11,7 @@

    {{$profile.name|escape}}

    {{if $profile.account_type}}{{$profile.account_type}}{{/if}}
    - {{$profile.addr|escaped}} + {{$profile.addr|escape}} {{if $profile.network}} ({{$profile.network}}){{/if}}
    {{*{{if $profile.about}}
    {{$profile.about}}
    {{/if}}*}} diff --git a/view/templates/profile_vcard.tpl b/view/templates/profile_vcard.tpl index fb7875641..14e1a0373 100644 --- a/view/templates/profile_vcard.tpl +++ b/view/templates/profile_vcard.tpl @@ -3,7 +3,7 @@
    {{$profile.name|escape}}
    - {{if $profile.addr}}
    {{$profile.addr|escaped}}
    {{/if}} + {{if $profile.addr}}
    {{$profile.addr|escape}}
    {{/if}} {{if $profile.pdesc}}
    {{$profile.pdesc}}
    {{/if}} diff --git a/view/templates/remote_friends_common.tpl b/view/templates/remote_friends_common.tpl index f018727c0..f5f43360a 100644 --- a/view/templates/remote_friends_common.tpl +++ b/view/templates/remote_friends_common.tpl @@ -6,12 +6,12 @@
    - {{$item.name|escaped}} + {{$item.name|escape}}
    - {{$item.name|escaped}} + {{$item.name|escape}}
    diff --git a/view/templates/search_item.tpl b/view/templates/search_item.tpl index c004fe74c..a97574b7b 100644 --- a/view/templates/search_item.tpl +++ b/view/templates/search_item.tpl @@ -7,7 +7,7 @@ onmouseover="if (typeof t{{$item.id}} != 'undefined') clearTimeout(t{{$item.id}}); openMenu('wall-item-photo-menu-button-{{$item.id}}')" onmouseout="t{{$item.id}}=setTimeout('closeMenu(\'wall-item-photo-menu-button-{{$item.id}}\'); closeMenu(\'wall-item-photo-menu-{{$item.id}}\');',200)"> - {{$item.name|escaped}} + {{$item.name|escape}}menu
      @@ -23,7 +23,7 @@
    - {{$item.name|escaped}} + {{$item.name|escape}}
    {{$item.ago}}
    diff --git a/view/templates/wall_thread.tpl b/view/templates/wall_thread.tpl index 6108b80c6..6f54d024d 100644 --- a/view/templates/wall_thread.tpl +++ b/view/templates/wall_thread.tpl @@ -44,7 +44,7 @@
    - {{$item.name|escaped}}{{if $item.owner_url}} {{$item.to}} {{$item.owner_name|escaped}} {{$item.vwall}}{{/if}}
    + {{$item.name|escape}}{{if $item.owner_url}} {{$item.to}} {{$item.owner_name|escape}} {{$item.vwall}}{{/if}}
    diff --git a/view/theme/duepuntozero/templates/profile_vcard.tpl b/view/theme/duepuntozero/templates/profile_vcard.tpl index 311132b81..31afc71fe 100644 --- a/view/theme/duepuntozero/templates/profile_vcard.tpl +++ b/view/theme/duepuntozero/templates/profile_vcard.tpl @@ -3,7 +3,7 @@
    {{$profile.name|escape}}
    - {{if $profile.addr}}
    {{$profile.addr|escaped}}
    {{/if}} + {{if $profile.addr}}
    {{$profile.addr|escape}}
    {{/if}} {{if $profile.pdesc}}
    {{$profile.pdesc}}
    {{/if}}
    {{$profile.name|escape}}
    diff --git a/view/theme/quattro/templates/profile_vcard.tpl b/view/theme/quattro/templates/profile_vcard.tpl index e62da464d..a316f58aa 100644 --- a/view/theme/quattro/templates/profile_vcard.tpl +++ b/view/theme/quattro/templates/profile_vcard.tpl @@ -26,7 +26,7 @@ {{/if}}
    - {{if $profile.addr}}
    {{$profile.addr|escaped}}
    {{/if}} + {{if $profile.addr}}
    {{$profile.addr|escape}}
    {{/if}} {{if $pdesc}}
    {{$profile.pdesc}}
    {{/if}}
    {{$profile.name|escape}}
    diff --git a/view/theme/smoothly/templates/search_item.tpl b/view/theme/smoothly/templates/search_item.tpl index 46cbff692..2c9e62193 100644 --- a/view/theme/smoothly/templates/search_item.tpl +++ b/view/theme/smoothly/templates/search_item.tpl @@ -6,7 +6,7 @@ onmouseover="if (typeof t{{$item.id}} != 'undefined') clearTimeout(t{{$item.id}}); openMenu('wall-item-photo-menu-button-{{$item.id}}')" onmouseout="t{{$item.id}}=setTimeout('closeMenu(\'wall-item-photo-menu-button-{{$item.id}}\'); closeMenu(\'wall-item-photo-menu-{{$item.id}}\');',200)"> - {{$item.name|escaped}} + {{$item.name|escape}}menu
      @@ -34,7 +34,7 @@
      {{$item.body}}
    - {{$item.name|escaped}} + {{$item.name|escape}}
    {{$item.ago}}
    diff --git a/view/theme/smoothly/templates/wall_thread.tpl b/view/theme/smoothly/templates/wall_thread.tpl index b62b077e2..616c20f4d 100644 --- a/view/theme/smoothly/templates/wall_thread.tpl +++ b/view/theme/smoothly/templates/wall_thread.tpl @@ -15,7 +15,7 @@ {{if $item.owner_url}}
    - {{$item.owner_name|escaped}} + {{$item.owner_name|escape}}
    {{$item.wall}}
    {{/if}} @@ -23,7 +23,7 @@ onmouseover="if (typeof t{{$item.id}} != 'undefined') clearTimeout(t{{$item.id}}); openMenu('wall-item-photo-menu-button-{{$item.id}}')" onmouseout="t{{$item.id}}=setTimeout('closeMenu(\'wall-item-photo-menu-button-{{$item.id}}\'); closeMenu(\'wall-item-photo-menu-{{$item.id}}\');',200)"> - {{$item.name|escaped}} + {{$item.name|escape}}menu
      @@ -47,7 +47,7 @@
      - {{$item.name|escaped}} + {{$item.name|escape}}
      •
      diff --git a/view/theme/vier/templates/profile_vcard.tpl b/view/theme/vier/templates/profile_vcard.tpl index 1733969aa..a46441695 100644 --- a/view/theme/vier/templates/profile_vcard.tpl +++ b/view/theme/vier/templates/profile_vcard.tpl @@ -13,7 +13,7 @@ {{/if}}
      - {{if $profile.addr}}
      {{$profile.addr|escaped}}
      {{/if}} + {{if $profile.addr}}
      {{$profile.addr|escape}}
      {{/if}} {{if $profile.pdesc}}
      {{$profile.pdesc}}
      {{/if}} From 069c92049a99f78baa494f8be3bb014f194e86d1 Mon Sep 17 00:00:00 2001 From: Michael Date: Sun, 25 Nov 2018 23:49:40 +0000 Subject: [PATCH 7/7] Just some misspelling --- view/theme/frio/templates/contact_template.tpl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/view/theme/frio/templates/contact_template.tpl b/view/theme/frio/templates/contact_template.tpl index 1b56a6b62..604f8d7e5 100644 --- a/view/theme/frio/templates/contact_template.tpl +++ b/view/theme/frio/templates/contact_template.tpl @@ -9,7 +9,7 @@ {{$contact.name|escape}}
      - {{* For very small displays we use a drobdown menu for contact relating actions *}} + {{* For very small displays we use a dropdown menu for contact relating actions *}}
    {{$u.created}}{{$u.name}}{{$u.name|escape}} {{$u.email}} - - + +
    {{$u.name}} {{$u.name|escape}} {{$u.email}}{{$u.register_date}}
    {{$u.name}}{{$u.name|escape}} {{$u.email}} {{$u.deleted}}
    {{$contact.nickname|escape}}{{$contact.name}}{{$contact.addr}}{{$contact.name|escaped}}{{$contact.addr|escaped}} {{$contact.url}}
    {{$contact.nickname|escape}}{{$contact.name|escaped}}{{$contact.addr|escaped}}{{$contact.name|escape}}{{$contact.addr|escape}} {{$contact.url}}