From 4f9f86e310a433d56622527be002ba2a474c5240 Mon Sep 17 00:00:00 2001 From: Michael Date: Sun, 25 Nov 2018 18:56:26 +0000 Subject: [PATCH 1/7] We are now escaping many template fields --- src/Module/Contact.php | 10 +-- src/Object/Post.php | 6 +- view/templates/admin/addon_details.tpl | 2 +- view/templates/admin/contactblock.tpl | 4 +- view/templates/admin/users.tpl | 16 ++-- view/templates/hovercard.tpl | 14 ++-- view/templates/profile_vcard.tpl | 6 +- view/templates/vcard-widget.tpl | 10 +-- view/templates/wall_thread.tpl | 8 +- view/templates/widget_forumlist.tpl | 8 +- .../duepuntozero/templates/profile_vcard.tpl | 4 +- view/theme/frio/templates/admin/addons.tpl | 2 +- .../frio/templates/admin/contactblock.tpl | 8 +- view/theme/frio/templates/admin/queue.tpl | 12 +-- view/theme/frio/templates/admin/summary.tpl | 6 +- view/theme/frio/templates/admin/users.tpl | 24 +++--- view/theme/frio/templates/comment_item.tpl | 14 ++-- view/theme/frio/templates/common_tabs.tpl | 6 +- view/theme/frio/templates/contact_edit.tpl | 76 ++++++++--------- .../theme/frio/templates/contact_template.tpl | 40 ++++----- view/theme/frio/templates/credits.tpl | 4 +- view/theme/frio/templates/crepair.tpl | 2 +- view/theme/frio/templates/event.tpl | 10 +-- .../frio/templates/event_stream_item.tpl | 8 +- view/theme/frio/templates/events_js.tpl | 8 +- view/theme/frio/templates/filebrowser.tpl | 10 +-- view/theme/frio/templates/intros.tpl | 4 +- view/theme/frio/templates/jot.tpl | 2 +- view/theme/frio/templates/like_noshare.tpl | 2 +- view/theme/frio/templates/mail_conv.tpl | 4 +- view/theme/frio/templates/mail_list.tpl | 2 +- view/theme/frio/templates/nav.tpl | 84 +++++++++---------- view/theme/frio/templates/photo_item.tpl | 2 +- view/theme/frio/templates/photo_top.tpl | 2 +- view/theme/frio/templates/photo_view.tpl | 4 +- view/theme/frio/templates/profile_entry.tpl | 2 +- view/theme/frio/templates/profile_vcard.tpl | 46 +++++----- view/theme/frio/templates/search_item.tpl | 64 +++++++------- view/theme/frio/templates/vcard-widget.tpl | 10 +-- view/theme/frio/templates/wall_thread.tpl | 76 ++++++++--------- .../quattro/templates/contact_template.tpl | 8 +- view/theme/quattro/templates/events.tpl | 6 +- view/theme/quattro/templates/mail_conv.tpl | 18 ++-- .../theme/quattro/templates/profile_vcard.tpl | 8 +- view/theme/quattro/templates/search_item.tpl | 34 ++++---- .../theme/quattro/templates/wall_item_tag.tpl | 8 +- view/theme/quattro/templates/wall_thread.tpl | 10 +-- .../quattro/templates/widget_forumlist.tpl | 4 +- view/theme/vier/templates/ch_connectors.tpl | 2 +- .../vier/templates/ch_directory_item.tpl | 2 +- view/theme/vier/templates/comment_item.tpl | 16 ++-- .../theme/vier/templates/contact_template.tpl | 6 +- view/theme/vier/templates/nav.tpl | 48 +++++------ view/theme/vier/templates/photo_item.tpl | 30 +++---- view/theme/vier/templates/photo_view.tpl | 4 +- view/theme/vier/templates/profile_vcard.tpl | 6 +- view/theme/vier/templates/search_item.tpl | 36 ++++---- view/theme/vier/templates/wall_item_tag.tpl | 8 +- view/theme/vier/templates/wall_thread.tpl | 60 ++++++------- .../vier/templates/widget_forumlist_right.tpl | 12 +-- 60 files changed, 472 insertions(+), 476 deletions(-) diff --git a/src/Module/Contact.php b/src/Module/Contact.php index ec7e896925..66e8c97fdf 100644 --- a/src/Module/Contact.php +++ b/src/Module/Contact.php @@ -85,7 +85,7 @@ class Contact extends BaseModule /// @TODO Add nice spaces $vcard_widget = Renderer::replaceMacros(Renderer::getMarkupTemplate('vcard-widget.tpl'), [ - '$name' => htmlentities($contact['name']), + '$name' => $contact['name'], '$photo' => $contact['photo'], '$url' => Model\Contact::MagicLink($contact['url']), '$addr' => defaults($contact, 'addr', ''), @@ -639,7 +639,7 @@ class Contact extends BaseModule '$ffi_keyword_blacklist' => $contact['ffi_keyword_blacklist'], '$ffi_keyword_blacklist' => ['ffi_keyword_blacklist', L10n::t('Blacklisted keywords'), $contact['ffi_keyword_blacklist'], L10n::t('Comma separated list of keywords that should not be converted to hashtags, when "Fetch information and keywords" is selected')], '$photo' => $contact['photo'], - '$name' => htmlentities($contact['name']), + '$name' => $contact['name'], '$dir_icon' => $dir_icon, '$sparkle' => $sparkle, '$url' => $url, @@ -1033,14 +1033,14 @@ class Contact extends BaseModule 'alt_text' => $alt_text, 'dir_icon' => $dir_icon, 'thumb' => ProxyUtils::proxifyUrl($rr['thumb'], false, ProxyUtils::SIZE_THUMB), - 'name' => htmlentities($rr['name']), - 'username' => htmlentities($rr['name']), + 'name' => $rr['name'], + 'username' => $rr['name'], 'account_type' => Model\Contact::getAccountType($rr), 'sparkle' => $sparkle, 'itemurl' => defaults($rr, 'addr', $rr['url']), 'url' => $url, 'network' => ContactSelector::networkToName($rr['network'], $rr['url']), - 'nick' => htmlentities($rr['nick']), + 'nick' => $rr['nick'], ]; } diff --git a/src/Object/Post.php b/src/Object/Post.php index e7a9e6b020..50d903f025 100644 --- a/src/Object/Post.php +++ b/src/Object/Post.php @@ -213,7 +213,7 @@ class Post extends BaseObject $filer = (($conv->getProfileOwner() == local_user() && ($item['uid'] != 0)) ? L10n::t("save to folder") : false); - $profile_name = htmlentities($item['author-name']); + $profile_name = $item['author-name']; if (!empty($item['author-link']) && empty($item['author-name'])) { $profile_name = $item['author-link']; } @@ -377,7 +377,7 @@ class Post extends BaseObject 'isevent' => $isevent, 'attend' => $attend, 'linktitle' => L10n::t('View %s\'s profile @ %s', $profile_name, $item['author-link']), - 'olinktitle' => L10n::t('View %s\'s profile @ %s', htmlentities($this->getOwnerName()), $item['owner-link']), + 'olinktitle' => L10n::t('View %s\'s profile @ %s', $this->getOwnerName(), $item['owner-link']), 'to' => L10n::t('to'), 'via' => L10n::t('via'), 'wall' => L10n::t('Wall-to-Wall'), @@ -399,7 +399,7 @@ class Post extends BaseObject 'shiny' => $shiny, 'owner_url' => $this->getOwnerUrl(), 'owner_photo' => $a->removeBaseURL(ProxyUtils::proxifyUrl($item['owner-avatar'], false, ProxyUtils::SIZE_THUMB)), - 'owner_name' => htmlentities($owner_name_e), + 'owner_name' => $owner_name_e, 'plink' => Item::getPlink($item), 'edpost' => $edpost, 'isstarred' => $isstarred, diff --git a/view/templates/admin/addon_details.tpl b/view/templates/admin/addon_details.tpl index fb908b7058..96b26d2d09 100644 --- a/view/templates/admin/addon_details.tpl +++ b/view/templates/admin/addon_details.tpl @@ -18,7 +18,7 @@

{{if $screenshot}} - {{$screenshot.1}} + {{$screenshot.1|escape}} {{/if}} {{if $admin_form}} diff --git a/view/templates/admin/contactblock.tpl b/view/templates/admin/contactblock.tpl index 152550f017..c9bfc2efd0 100644 --- a/view/templates/admin/contactblock.tpl +++ b/view/templates/admin/contactblock.tpl @@ -32,10 +32,10 @@ {{foreach $contacts as $contact}} - {{$contact.nickname}} + {{$contact.nickname|escape}} {{$contact.name}} {{$contact.addr}} - {{$contact.url}} + {{$contact.url}} {{/foreach}} diff --git a/view/templates/admin/users.tpl b/view/templates/admin/users.tpl index b2b0d615a4..f06b0f9734 100644 --- a/view/templates/admin/users.tpl +++ b/view/templates/admin/users.tpl @@ -35,8 +35,8 @@ {{$u.email}} - - + + @@ -79,8 +79,8 @@ {{foreach $users as $u}} - {{$u.nickname}} - {{$u.name}} + {{$u.nickname|escape}} + {{$u.name}} {{$u.email}} {{$u.register_date}} {{$u.login_date}} @@ -94,8 +94,8 @@ {{/if}} {{if $u.is_deletable}} - - + + {{else}}   {{/if}} @@ -122,8 +122,8 @@ {{foreach $deleted as $u}} - {{$u.nickname}} - {{$u.name}} + {{$u.nickname|escape}} + {{$u.name}} {{$u.email}} {{$u.register_date}} {{$u.login_date}} diff --git a/view/templates/hovercard.tpl b/view/templates/hovercard.tpl index 7bf37e74b3..74f2700052 100644 --- a/view/templates/hovercard.tpl +++ b/view/templates/hovercard.tpl @@ -3,12 +3,12 @@
- {{$profile.name}} + {{$profile.name|escape}}
-

{{$profile.name}}

{{if $profile.account_type}}{{$profile.account_type}}{{/if}} +

{{$profile.name|escape}}

{{if $profile.account_type}}{{$profile.account_type}}{{/if}}
{{$profile.addr}} @@ -21,13 +21,13 @@ {{* here are the differnt actions like privat message, poke, delete and so on *}} {{* @todo we have two different photo menus one for contacts and one for items at the network stream. We currently use the contact photo menu, so the items options are missing We need to move them *}}
- {{if $profile.actions.pm}}{{/if}} - {{if $profile.actions.poke}}{{/if}} + {{if $profile.actions.pm}}{{/if}} + {{if $profile.actions.poke}}{{/if}}
- {{if $profile.actions.network}}{{/if}} - {{if $profile.actions.edit}}{{/if}} - {{if $profile.actions.follow}}{{/if}} + {{if $profile.actions.network}}{{/if}} + {{if $profile.actions.edit}}{{/if}} + {{if $profile.actions.follow}}{{/if}}
diff --git a/view/templates/profile_vcard.tpl b/view/templates/profile_vcard.tpl index b56dd607ce..6f8e86b299 100644 --- a/view/templates/profile_vcard.tpl +++ b/view/templates/profile_vcard.tpl @@ -1,16 +1,16 @@
-
{{$profile.name}}
+
{{$profile.name|escape}}
{{if $profile.addr}}
{{$profile.addr}}
{{/if}} {{if $profile.pdesc}}
{{$profile.pdesc}}
{{/if}} {{if $profile.picdate}} -
{{$profile.name}}
+
{{$profile.name|escape}}
{{else}} -
{{$profile.name}}
+
{{$profile.name|escape}}
{{/if}} {{if $account_type}}{{/if}} {{if $profile.network_name}}
{{$network}}
{{$profile.network_name}}
{{/if}} diff --git a/view/templates/vcard-widget.tpl b/view/templates/vcard-widget.tpl index 47b64b68da..eed94193f5 100644 --- a/view/templates/vcard-widget.tpl +++ b/view/templates/vcard-widget.tpl @@ -1,14 +1,14 @@
-
{{$name}}
- {{if $addr}}
{{$addr}}
{{/if}} +
{{$name|escape}}
+ {{if $addr}}
{{$addr|escape}}
{{/if}} {{if $pdesc}}
{{$pdesc}}
{{/if}} {{if $url}} -
{{$name}}
+
{{$name|escape}}
{{else}} -
{{$name}}
+
{{$name|escape}}
{{/if}} - {{if $account_type}}{{/if}} + {{if $account_type}}{{/if}} {{if $network_name}}
{{$network}}
{{$network_name}}
{{/if}}
diff --git a/view/templates/wall_thread.tpl b/view/templates/wall_thread.tpl index a82efa7d1c..63a8364f88 100644 --- a/view/templates/wall_thread.tpl +++ b/view/templates/wall_thread.tpl @@ -19,15 +19,15 @@ {{if $item.owner_url}}
- {{$item.owner_name}} + {{$item.owner_name|escape}}
-
{{$item.wall}}
+
{{$item.wall|escape}}
{{/if}}
- {{$item.name}} + {{$item.name|escape}} menu
    @@ -38,7 +38,7 @@
- {{if $item.lock}}
{{$item.lock}}
+ {{if $item.lock}}
{{$item.lock|escape}}
{{else}}
{{/if}}
{{$item.location}}
diff --git a/view/templates/widget_forumlist.tpl b/view/templates/widget_forumlist.tpl index 32da71f816..da30967cd6 100644 --- a/view/templates/widget_forumlist.tpl +++ b/view/templates/widget_forumlist.tpl @@ -21,8 +21,8 @@ function showHideForumlist() { {{if $forum.id <= $visible_forums}} @@ -31,8 +31,8 @@ function showHideForumlist() { {{if $forum.id > $visible_forums}} diff --git a/view/theme/duepuntozero/templates/profile_vcard.tpl b/view/theme/duepuntozero/templates/profile_vcard.tpl index 186b7e4490..505cf560e3 100644 --- a/view/theme/duepuntozero/templates/profile_vcard.tpl +++ b/view/theme/duepuntozero/templates/profile_vcard.tpl @@ -1,12 +1,12 @@
-
{{$profile.name}}
+
{{$profile.name|escape}}
{{if $profile.addr}}
{{$profile.addr}}
{{/if}} {{if $profile.pdesc}}
{{$profile.pdesc}}
{{/if}} -
{{$profile.name}}
+
{{$profile.name|escape}}
{{if $account_type}}{{/if}} diff --git a/view/theme/frio/templates/admin/addons.tpl b/view/theme/frio/templates/admin/addons.tpl index 220abdc2c4..38efb62bd4 100644 --- a/view/theme/frio/templates/admin/addons.tpl +++ b/view/theme/frio/templates/admin/addons.tpl @@ -12,7 +12,7 @@
  • - {{$p.2.name}} - {{$p.2.version}} + {{$p.2.name|escape}} - {{$p.2.version}} {{if $p.2.experimental}} {{$experimental}} {{/if}}{{if $p.2.unsupported}} {{$unsupported}} {{/if}}
    {{$p.2.description}}
    • diff --git a/view/theme/frio/templates/admin/contactblock.tpl b/view/theme/frio/templates/admin/contactblock.tpl index 3173c238b6..3ac9a25173 100644 --- a/view/theme/frio/templates/admin/contactblock.tpl +++ b/view/theme/frio/templates/admin/contactblock.tpl @@ -67,9 +67,9 @@
    - {{$contact.nickname}} - {{$contact.name}} - {{$contact.url}} + {{$contact.nickname|escape}} + {{$contact.name|escape}} + {{$contact.url|escape}} {{/foreach}} @@ -78,7 +78,7 @@ {{* Checkbox to select all blocked contacts *}}
    - +
    diff --git a/view/theme/frio/templates/admin/queue.tpl b/view/theme/frio/templates/admin/queue.tpl index dde3863999..3ebe89052e 100644 --- a/view/theme/frio/templates/admin/queue.tpl +++ b/view/theme/frio/templates/admin/queue.tpl @@ -13,12 +13,12 @@ {{foreach $entries as $e}} - {{$e.id}} - {{$e.name}} - {{$e.nurl}} - {{$e.network}} - {{$e.created}} - {{$e.last}} + {{$e.id|escape}} + {{$e.name|escape}} + {{$e.nurl|escape}} + {{$e.network|escape}} + {{$e.created|escape}} + {{$e.last|escape}} {{/foreach}} diff --git a/view/theme/frio/templates/admin/summary.tpl b/view/theme/frio/templates/admin/summary.tpl index 66afda721b..c2bbf49a70 100644 --- a/view/theme/frio/templates/admin/summary.tpl +++ b/view/theme/frio/templates/admin/summary.tpl @@ -54,14 +54,14 @@ {{* The Friendica version. *}}
    -
    {{$version.0}}
    -
    {{$platform}} '{{$codename}}' {{$version.1}} - {{$build}}
    +
    {{$version.0|escape}}
    +
    {{$platform}} '{{$codename|escape}}' {{$version.1|escape}} - {{$build|escape}}
    {{* Server Settings. *}}
    -
    {{$serversettings.label}}
    +
    {{$serversettings.label|escape}}
    diff --git a/view/theme/frio/templates/admin/users.tpl b/view/theme/frio/templates/admin/users.tpl index 92ef9be6fa..031ffd0a47 100644 --- a/view/theme/frio/templates/admin/users.tpl +++ b/view/theme/frio/templates/admin/users.tpl @@ -46,11 +46,11 @@ - + {{if $u.note}} @@ -145,8 +145,8 @@   {{/if}} - - + + {{if $order_users == $th_users.2.1}} @@ -169,18 +169,18 @@ {{if $u.page_flags_raw==3}}fa-heart{{/if}} {{* PAGE_FREELOVE *}} {{if $u.page_flags_raw==4}}fa-rss{{/if}} {{* PAGE_BLOG *}} {{if $u.page_flags_raw==5}}fa-user-secret{{/if}} {{* PAGE_PRVGROUP *}} - " title="{{$u.page_flags}}"> + " title="{{$u.page_flags|escape}}"> {{if $u.page_flags_raw==0 && $u.account_type_raw > 0}} {{/if}} - {{if $u.is_admin}}{{/if}} - {{if $u.account_expired}}{{/if}} + {{if $u.is_admin}}{{/if}} + {{if $u.account_expired}}{{/if}} {{/if}} @@ -229,7 +229,7 @@ {{/if}} - + {{else}} @@ -297,8 +297,8 @@ {{foreach $deleted as $u}} - - + + diff --git a/view/theme/frio/templates/comment_item.tpl b/view/theme/frio/templates/comment_item.tpl index 4ef5f2caa1..804d07ac01 100644 --- a/view/theme/frio/templates/comment_item.tpl +++ b/view/theme/frio/templates/comment_item.tpl @@ -33,37 +33,37 @@ {{/if}}
    • -
    • -
    • -
    • -
    • -
    • -
    • -
      • diff --git a/view/theme/frio/templates/common_tabs.tpl b/view/theme/frio/templates/common_tabs.tpl index 76c6db0398..207ffefcb9 100644 --- a/view/theme/frio/templates/common_tabs.tpl +++ b/view/theme/frio/templates/common_tabs.tpl @@ -6,7 +6,7 @@
      • @@ -31,7 +31,7 @@ @@ -35,35 +35,35 @@
      - {{$contact_status}} + {{$contact_status|escape}} {{* Block with status information about the contact *}}
        - {{if $relation_text}}
      • {{$relation_text}}
        • {{/if}} - {{if $nettype}}
      • {{$nettype}}
        • {{/if}} + {{if $relation_text}}
      • {{$relation_text|escape}}
        • {{/if}} + {{if $nettype}}
      • {{$nettype|escape}}
        • {{/if}} {{if $poll_enabled}} -
      • {{$lastupdtext}} {{$last_update}}
        +
      • {{$lastupdtext|escape}} {{$last_update|escape}}
        {{if $poll_interval}}
        - {{$updpub}} {{$poll_interval}} + {{$updpub|escape}} {{$poll_interval}} {{/if}}
        • {{/if}} - {{if $lost_contact}}
      • {{$lost_contact}}
        • {{/if}} - {{if $insecure}}
      • {{$insecure}}
        • {{/if}} - {{if $blocked && !$pending}}
      • {{$blocked}}
        • {{/if}} - {{if $pending}}
      • {{$pending}}
        • {{/if}} - {{if $ignored}}
      • {{$ignored}}
        • {{/if}} - {{if $archived}}
      • {{$archived}}
        • {{/if}} + {{if $lost_contact}}
      • {{$lost_contact|escape}}
        • {{/if}} + {{if $insecure}}
      • {{$insecure|escape}}
        • {{/if}} + {{if $blocked && !$pending}}
      • {{$blocked|escape}}
        • {{/if}} + {{if $pending}}
      • {{$pending|escape}}
        • {{/if}} + {{if $ignored}}
      • {{$ignored|escape}}
        • {{/if}} + {{if $archived}}
      • {{$archived|escape}}
        • {{/if}}
      {{* End of contact-edit-status-wrapper *}} @@ -83,38 +83,38 @@
      -
      {{$profileurllabel}}
      {{$profileurl}} +
      {{$profileurllabel|escape}}
      {{$profileurl|escape}}
      {{if $location}}
      -
      {{$location_label}}
      -
      {{$location}}
      +
      {{$location_label|escape}}
      +
      {{$location|escape}}
      {{/if}} {{if $xmpp}}
      -
      {{$xmpp_label}}
      -
      {{$xmpp}}
      +
      {{$xmpp_label|escape}}
      +
      {{$xmpp|escape}}
      {{/if}} {{if $keywords}}
      -
      {{$keywords_label}}
      -
      {{$keywords}}
      +
      {{$keywords_label|escape}}
      +
      {{$keywords|escape}}
      {{/if}} {{if $about}}
      -
      {{$about_label}}
      -
      {{$about}}
      +
      {{$about_label|escape}}
      +
      {{$about|escape}}
      {{/if}}
      @@ -127,14 +127,14 @@
      - + {{include file="field_checkbox.tpl" field=$notify}} {{if $fetch_further_information}} @@ -144,7 +144,7 @@ {{include file="field_checkbox.tpl" field=$hidden}}
      - +
      @@ -157,7 +157,7 @@ @@ -167,11 +167,11 @@ {{include file="field_textarea.tpl" field=$cinfo}}
      - +
      {{if $reason}} -

      {{$lbl_info2}}

      +

      {{$lbl_info2|escape}}

      {{$reason}}

      {{/if}} @@ -184,7 +184,7 @@ @@ -192,7 +192,7 @@
      {{if $profile_select}}
      -

      {{$lbl_vis2}}

      +

      {{$lbl_vis2|escape}}

      {{$profile_select}} @@ -201,7 +201,7 @@ {{/if}}
      - +
      diff --git a/view/theme/frio/templates/contact_template.tpl b/view/theme/frio/templates/contact_template.tpl index e1c0a77009..4f07ad2b1d 100644 --- a/view/theme/frio/templates/contact_template.tpl +++ b/view/theme/frio/templates/contact_template.tpl @@ -6,14 +6,14 @@
      {{* For very small displays we use a drobdown menu for contact relating actions *}} {{/if}} {{if $contact.photo_menu.poke}} - {{/if}} {{if $contact.photo_menu.network}} - + {{/if}} {{if $contact.photo_menu.edit}} - + {{/if}} {{if $contact.photo_menu.drop}} - {{/if}} {{if $contact.photo_menu.follow}} - + {{/if}} {{if $contact.photo_menu.hide}} - + {{/if}} @@ -84,7 +84,7 @@ {{* The button to add or remove contacts from a contact group - group edit page *}} {{if $contact.change_member}}
      - {/if} {if $photo_menu.poke} - {/if} {if $photo_menu.network} - + {/if} {if $photo_menu.edit} - + {/if} {if $photo_menu.drop} - + {/if} {if $photo_menu.follow} - + {/if} @@ -207,7 +207,7 @@ We use this part to filter the contacts with jquery.textcomplete *}} {{* The button to add or remove contacts from a contact group - group edit page *}} {if $contact.change_member}
      - {{/if}} - {{if $event.copy}}{{/if}} - {{if $event.drop}}{{/if}} - {{if $event.item.plink}}{{/if}} + {{if $event.edit}}{{/if}} + {{if $event.copy}}{{/if}} + {{if $event.drop}}{{/if}} + {{if $event.item.plink}}{{/if}}
      diff --git a/view/theme/frio/templates/event_stream_item.tpl b/view/theme/frio/templates/event_stream_item.tpl index 87c2e70cad..58f39a0ee1 100644 --- a/view/theme/frio/templates/event_stream_item.tpl +++ b/view/theme/frio/templates/event_stream_item.tpl @@ -17,16 +17,16 @@ {{if $location.map}}{{/if}}
      - {{$start_short}} - {{if $finish}} - {{if $same_date}}{{$end_time}}{{else}}{{$end_short}}{{/if}}{{/if}} + {{$start_short}} + {{if $finish}} - {{if $same_date}}{{$end_time}}{{else}}{{$end_short}}{{/if}}{{/if}} {{if $location.name}} - {{$location.name}} + {{$location.name|escape}} {{/if}}
      - {{$author_name}} + {{$author_name|escape}}
      {{if $location.map}}
      {{$location.map}}
      diff --git a/view/theme/frio/templates/events_js.tpl b/view/theme/frio/templates/events_js.tpl index a4ca9004cd..3866282a33 100644 --- a/view/theme/frio/templates/events_js.tpl +++ b/view/theme/frio/templates/events_js.tpl @@ -5,7 +5,7 @@ {{* The link to create a new event *}} {{if $new_event.0}} @@ -40,9 +40,9 @@ {{* The buttons to change the month/weeks/days *}}
      - - - + + +
      {{* The title (e.g. name of the mont/week/day) *}} diff --git a/view/theme/frio/templates/filebrowser.tpl b/view/theme/frio/templates/filebrowser.tpl index d452810c88..ce58ef0b98 100644 --- a/view/theme/frio/templates/filebrowser.tpl +++ b/view/theme/frio/templates/filebrowser.tpl @@ -9,8 +9,8 @@
      - - + + -

      {{$fullname}}

      +

      {{$fullname|escape}}

      {{$str_notifytype}} {{$notify_type}}
      {{* if the contact was suggestested by another contact, the contact who made the suggestion is displayed*}} {{if $madeby}}
      {{$lbl_madeby}} {{$madeby}}
      {{/if}} @@ -51,7 +51,7 @@ a bootstrap modal in the case of approval *}} diff --git a/view/theme/frio/templates/mail_conv.tpl b/view/theme/frio/templates/mail_conv.tpl index 2ad9898495..b5154aa4c0 100644 --- a/view/theme/frio/templates/mail_conv.tpl +++ b/view/theme/frio/templates/mail_conv.tpl @@ -2,13 +2,13 @@
      - {{$mail.from_name}} + {{$mail.from_name|escape}}
      {{$mail.date}}
      -

      {{$mail.from_name}}

      +

      {{$mail.from_name|escape}}

      {{$mail.body}} diff --git a/view/theme/frio/templates/mail_list.tpl b/view/theme/frio/templates/mail_list.tpl index 4a797d47c0..225fd71c18 100644 --- a/view/theme/frio/templates/mail_list.tpl +++ b/view/theme/frio/templates/mail_list.tpl @@ -5,7 +5,7 @@
      - {{$from_name}} + {{$from_name|escape}}
      diff --git a/view/theme/frio/templates/nav.tpl b/view/theme/frio/templates/nav.tpl index d64eae9c49..6f20c247c4 100644 --- a/view/theme/frio/templates/nav.tpl +++ b/view/theme/frio/templates/nav.tpl @@ -40,37 +40,37 @@
    - - + + {{/foreach}} diff --git a/view/templates/hovercard.tpl b/view/templates/hovercard.tpl index 74f2700052..5487a4cd05 100644 --- a/view/templates/hovercard.tpl +++ b/view/templates/hovercard.tpl @@ -11,7 +11,7 @@

    {{$profile.name|escape}}

    {{if $profile.account_type}}{{$profile.account_type}}{{/if}}
    - {{$profile.addr}} + {{$profile.addr|escaped}} {{if $profile.network}} ({{$profile.network}}){{/if}}
    {{*{{if $profile.about}}
    {{$profile.about}}
    {{/if}}*}} diff --git a/view/templates/profile_vcard.tpl b/view/templates/profile_vcard.tpl index 6f8e86b299..fb78756415 100644 --- a/view/templates/profile_vcard.tpl +++ b/view/templates/profile_vcard.tpl @@ -3,7 +3,7 @@
    {{$profile.name|escape}}
    - {{if $profile.addr}}
    {{$profile.addr}}
    {{/if}} + {{if $profile.addr}}
    {{$profile.addr|escaped}}
    {{/if}} {{if $profile.pdesc}}
    {{$profile.pdesc}}
    {{/if}} diff --git a/view/templates/remote_friends_common.tpl b/view/templates/remote_friends_common.tpl index 354c8e46a2..f018727c06 100644 --- a/view/templates/remote_friends_common.tpl +++ b/view/templates/remote_friends_common.tpl @@ -6,12 +6,12 @@
    - {{$item.name}} + {{$item.name|escaped}}
    - {{$item.name}} + {{$item.name|escaped}}
    diff --git a/view/templates/search_item.tpl b/view/templates/search_item.tpl index fbcf770f1b..462624957e 100644 --- a/view/templates/search_item.tpl +++ b/view/templates/search_item.tpl @@ -7,7 +7,7 @@ onmouseover="if (typeof t{{$item.id}} != 'undefined') clearTimeout(t{{$item.id}}); openMenu('wall-item-photo-menu-button-{{$item.id}}')" onmouseout="t{{$item.id}}=setTimeout('closeMenu(\'wall-item-photo-menu-button-{{$item.id}}\'); closeMenu(\'wall-item-photo-menu-{{$item.id}}\');',200)"> - {{$item.name}} + {{$item.name|escaped}}menu
      @@ -23,7 +23,7 @@
    - {{$item.name}} + {{$item.name|escaped}}
    {{$item.ago}}
    diff --git a/view/templates/wall_thread.tpl b/view/templates/wall_thread.tpl index 63a8364f88..113a93e8c9 100644 --- a/view/templates/wall_thread.tpl +++ b/view/templates/wall_thread.tpl @@ -44,7 +44,7 @@
    - {{$item.name}}{{if $item.owner_url}} {{$item.to}} {{$item.owner_name}} {{$item.vwall}}{{/if}}
    + {{$item.name|escaped}}{{if $item.owner_url}} {{$item.to}} {{$item.owner_name|escaped}} {{$item.vwall}}{{/if}}
    diff --git a/view/theme/duepuntozero/templates/profile_vcard.tpl b/view/theme/duepuntozero/templates/profile_vcard.tpl index 505cf560e3..311132b815 100644 --- a/view/theme/duepuntozero/templates/profile_vcard.tpl +++ b/view/theme/duepuntozero/templates/profile_vcard.tpl @@ -3,7 +3,7 @@
    {{$profile.name|escape}}
    - {{if $profile.addr}}
    {{$profile.addr}}
    {{/if}} + {{if $profile.addr}}
    {{$profile.addr|escaped}}
    {{/if}} {{if $profile.pdesc}}
    {{$profile.pdesc}}
    {{/if}}
    {{$profile.name|escape}}
    diff --git a/view/theme/quattro/templates/profile_vcard.tpl b/view/theme/quattro/templates/profile_vcard.tpl index f999f1f572..e62da464d9 100644 --- a/view/theme/quattro/templates/profile_vcard.tpl +++ b/view/theme/quattro/templates/profile_vcard.tpl @@ -26,7 +26,7 @@ {{/if}}
    - {{if $profile.addr}}
    {{$profile.addr}}
    {{/if}} + {{if $profile.addr}}
    {{$profile.addr|escaped}}
    {{/if}} {{if $pdesc}}
    {{$profile.pdesc}}
    {{/if}}
    {{$profile.name|escape}}
    diff --git a/view/theme/smoothly/templates/search_item.tpl b/view/theme/smoothly/templates/search_item.tpl index d441ebe2de..35820088b5 100644 --- a/view/theme/smoothly/templates/search_item.tpl +++ b/view/theme/smoothly/templates/search_item.tpl @@ -6,7 +6,7 @@ onmouseover="if (typeof t{{$item.id}} != 'undefined') clearTimeout(t{{$item.id}}); openMenu('wall-item-photo-menu-button-{{$item.id}}')" onmouseout="t{{$item.id}}=setTimeout('closeMenu(\'wall-item-photo-menu-button-{{$item.id}}\'); closeMenu(\'wall-item-photo-menu-{{$item.id}}\');',200)"> - {{$item.name}} + {{$item.name|escaped}}menu
      @@ -34,7 +34,7 @@
      {{$item.body}}
    - {{$item.name}} + {{$item.name|escaped}}
    {{$item.ago}}
    diff --git a/view/theme/smoothly/templates/wall_thread.tpl b/view/theme/smoothly/templates/wall_thread.tpl index 5aaa9c4eb1..f4c4154a02 100644 --- a/view/theme/smoothly/templates/wall_thread.tpl +++ b/view/theme/smoothly/templates/wall_thread.tpl @@ -15,7 +15,7 @@ {{if $item.owner_url}}
    - {{$item.owner_name}} + {{$item.owner_name|escaped}}
    {{$item.wall}}
    {{/if}} @@ -23,7 +23,7 @@ onmouseover="if (typeof t{{$item.id}} != 'undefined') clearTimeout(t{{$item.id}}); openMenu('wall-item-photo-menu-button-{{$item.id}}')" onmouseout="t{{$item.id}}=setTimeout('closeMenu(\'wall-item-photo-menu-button-{{$item.id}}\'); closeMenu(\'wall-item-photo-menu-{{$item.id}}\');',200)"> - {{$item.name}} + {{$item.name|escaped}}menu
      @@ -47,7 +47,7 @@
      - {{$item.name}} + {{$item.name|escaped}}
      •
      diff --git a/view/theme/vier/templates/profile_vcard.tpl b/view/theme/vier/templates/profile_vcard.tpl index 6ba3119caa..1733969aa8 100644 --- a/view/theme/vier/templates/profile_vcard.tpl +++ b/view/theme/vier/templates/profile_vcard.tpl @@ -13,7 +13,7 @@ {{/if}}
      - {{if $profile.addr}}
      {{$profile.addr}}
      {{/if}} + {{if $profile.addr}}
      {{$profile.addr|escaped}}
      {{/if}} {{if $profile.pdesc}}
      {{$profile.pdesc}}
      {{/if}} From 6075245b840a28e8c2d8976ddd624e59d3d2a81f Mon Sep 17 00:00:00 2001 From: Michael Date: Sun, 25 Nov 2018 20:34:02 +0000 Subject: [PATCH 5/7] Much more escapes --- view/templates/admin/site.tpl | 6 +++--- view/templates/birthdays_reminder.tpl | 4 ++-- view/templates/event_stream_item.tpl | 6 +++--- view/templates/events_reminder.tpl | 4 ++-- view/templates/files.tpl | 4 ++-- view/templates/photo_album.tpl | 4 ++-- view/templates/photo_top.tpl | 8 +++----- view/templates/photo_view.tpl | 2 +- view/templates/search_item.tpl | 8 ++++---- view/templates/settings/display.tpl | 2 +- view/templates/wall_thread.tpl | 2 +- view/theme/frio/templates/admin/site.tpl | 6 +++--- view/theme/frio/templates/photo_top.tpl | 2 +- view/theme/frio/templates/photo_view.tpl | 10 +++++----- view/theme/frio/templates/search_item.tpl | 4 ++-- view/theme/frio/templates/settings/display.tpl | 2 +- view/theme/frio/templates/theme_settings.tpl | 2 +- view/theme/frio/templates/wall_thread.tpl | 2 +- view/theme/quattro/templates/photo_item.tpl | 4 ++-- view/theme/quattro/templates/photo_view.tpl | 2 +- view/theme/quattro/templates/search_item.tpl | 4 ++-- view/theme/quattro/templates/wall_thread.tpl | 12 ++++++------ view/theme/smoothly/templates/search_item.tpl | 8 ++++---- view/theme/smoothly/templates/wall_thread.tpl | 10 +++++----- view/theme/vier/templates/communityhome.tpl | 6 +++--- view/theme/vier/templates/wall_thread.tpl | 4 ++-- 26 files changed, 63 insertions(+), 65 deletions(-) diff --git a/view/templates/admin/site.tpl b/view/templates/admin/site.tpl index bf1d215ec8..34b1e3b1b2 100644 --- a/view/templates/admin/site.tpl +++ b/view/templates/admin/site.tpl @@ -39,7 +39,7 @@ });
      -

      {{$title}} - {{$page}}

      +

      {{$title|escape}} - {{$page|escape}}

      @@ -145,7 +145,7 @@ {{include file="field_input.tpl" field=$dbclean_expire_conv}}
      -

      {{$worker_title}}

      +

      {{$worker_title|escape}}

      {{include file="field_input.tpl" field=$maxloadavg}} {{include file="field_input.tpl" field=$min_memory}} {{include file="field_input.tpl" field=$worker_queues}} @@ -155,7 +155,7 @@
      -

      {{$relay_title}}

      +

      {{$relay_title|escape}}

      {{include file="field_checkbox.tpl" field=$relay_subscribe}} {{include file="field_input.tpl" field=$relay_server}} {{include file="field_checkbox.tpl" field=$relay_directly}} diff --git a/view/templates/birthdays_reminder.tpl b/view/templates/birthdays_reminder.tpl index 6aa51d4702..9261ff8d32 100644 --- a/view/templates/birthdays_reminder.tpl +++ b/view/templates/birthdays_reminder.tpl @@ -1,10 +1,10 @@ {{if $count}} -
    - - + + {{/foreach}} diff --git a/view/templates/hovercard.tpl b/view/templates/hovercard.tpl index 5487a4cd05..ec87591b9f 100644 --- a/view/templates/hovercard.tpl +++ b/view/templates/hovercard.tpl @@ -11,7 +11,7 @@

    {{$profile.name|escape}}

    {{if $profile.account_type}}{{$profile.account_type}}{{/if}}
    - {{$profile.addr|escaped}} + {{$profile.addr|escape}} {{if $profile.network}} ({{$profile.network}}){{/if}}
    {{*{{if $profile.about}}
    {{$profile.about}}
    {{/if}}*}} diff --git a/view/templates/profile_vcard.tpl b/view/templates/profile_vcard.tpl index fb78756415..14e1a03736 100644 --- a/view/templates/profile_vcard.tpl +++ b/view/templates/profile_vcard.tpl @@ -3,7 +3,7 @@
    {{$profile.name|escape}}
    - {{if $profile.addr}}
    {{$profile.addr|escaped}}
    {{/if}} + {{if $profile.addr}}
    {{$profile.addr|escape}}
    {{/if}} {{if $profile.pdesc}}
    {{$profile.pdesc}}
    {{/if}} diff --git a/view/templates/remote_friends_common.tpl b/view/templates/remote_friends_common.tpl index f018727c06..f5f43360a7 100644 --- a/view/templates/remote_friends_common.tpl +++ b/view/templates/remote_friends_common.tpl @@ -6,12 +6,12 @@
    - {{$item.name|escaped}} + {{$item.name|escape}}
    - {{$item.name|escaped}} + {{$item.name|escape}}
    diff --git a/view/templates/search_item.tpl b/view/templates/search_item.tpl index c004fe74c4..a97574b7b4 100644 --- a/view/templates/search_item.tpl +++ b/view/templates/search_item.tpl @@ -7,7 +7,7 @@ onmouseover="if (typeof t{{$item.id}} != 'undefined') clearTimeout(t{{$item.id}}); openMenu('wall-item-photo-menu-button-{{$item.id}}')" onmouseout="t{{$item.id}}=setTimeout('closeMenu(\'wall-item-photo-menu-button-{{$item.id}}\'); closeMenu(\'wall-item-photo-menu-{{$item.id}}\');',200)"> - {{$item.name|escaped}} + {{$item.name|escape}}menu
      @@ -23,7 +23,7 @@
    - {{$item.name|escaped}} + {{$item.name|escape}}
    {{$item.ago}}
    diff --git a/view/templates/wall_thread.tpl b/view/templates/wall_thread.tpl index 6108b80c60..6f54d024da 100644 --- a/view/templates/wall_thread.tpl +++ b/view/templates/wall_thread.tpl @@ -44,7 +44,7 @@
    - {{$item.name|escaped}}{{if $item.owner_url}} {{$item.to}} {{$item.owner_name|escaped}} {{$item.vwall}}{{/if}}
    + {{$item.name|escape}}{{if $item.owner_url}} {{$item.to}} {{$item.owner_name|escape}} {{$item.vwall}}{{/if}}
    diff --git a/view/theme/duepuntozero/templates/profile_vcard.tpl b/view/theme/duepuntozero/templates/profile_vcard.tpl index 311132b815..31afc71fea 100644 --- a/view/theme/duepuntozero/templates/profile_vcard.tpl +++ b/view/theme/duepuntozero/templates/profile_vcard.tpl @@ -3,7 +3,7 @@
    {{$profile.name|escape}}
    - {{if $profile.addr}}
    {{$profile.addr|escaped}}
    {{/if}} + {{if $profile.addr}}
    {{$profile.addr|escape}}
    {{/if}} {{if $profile.pdesc}}
    {{$profile.pdesc}}
    {{/if}}
    {{$profile.name|escape}}
    diff --git a/view/theme/quattro/templates/profile_vcard.tpl b/view/theme/quattro/templates/profile_vcard.tpl index e62da464d9..a316f58aa5 100644 --- a/view/theme/quattro/templates/profile_vcard.tpl +++ b/view/theme/quattro/templates/profile_vcard.tpl @@ -26,7 +26,7 @@ {{/if}}
    - {{if $profile.addr}}
    {{$profile.addr|escaped}}
    {{/if}} + {{if $profile.addr}}
    {{$profile.addr|escape}}
    {{/if}} {{if $pdesc}}
    {{$profile.pdesc}}
    {{/if}}
    {{$profile.name|escape}}
    diff --git a/view/theme/smoothly/templates/search_item.tpl b/view/theme/smoothly/templates/search_item.tpl index 46cbff6928..2c9e621935 100644 --- a/view/theme/smoothly/templates/search_item.tpl +++ b/view/theme/smoothly/templates/search_item.tpl @@ -6,7 +6,7 @@ onmouseover="if (typeof t{{$item.id}} != 'undefined') clearTimeout(t{{$item.id}}); openMenu('wall-item-photo-menu-button-{{$item.id}}')" onmouseout="t{{$item.id}}=setTimeout('closeMenu(\'wall-item-photo-menu-button-{{$item.id}}\'); closeMenu(\'wall-item-photo-menu-{{$item.id}}\');',200)"> - {{$item.name|escaped}} + {{$item.name|escape}}menu
      @@ -34,7 +34,7 @@
      {{$item.body}}
    - {{$item.name|escaped}} + {{$item.name|escape}}
    {{$item.ago}}
    diff --git a/view/theme/smoothly/templates/wall_thread.tpl b/view/theme/smoothly/templates/wall_thread.tpl index b62b077e28..616c20f4dc 100644 --- a/view/theme/smoothly/templates/wall_thread.tpl +++ b/view/theme/smoothly/templates/wall_thread.tpl @@ -15,7 +15,7 @@ {{if $item.owner_url}}
    - {{$item.owner_name|escaped}} + {{$item.owner_name|escape}}
    {{$item.wall}}
    {{/if}} @@ -23,7 +23,7 @@ onmouseover="if (typeof t{{$item.id}} != 'undefined') clearTimeout(t{{$item.id}}); openMenu('wall-item-photo-menu-button-{{$item.id}}')" onmouseout="t{{$item.id}}=setTimeout('closeMenu(\'wall-item-photo-menu-button-{{$item.id}}\'); closeMenu(\'wall-item-photo-menu-{{$item.id}}\');',200)"> - {{$item.name|escaped}} + {{$item.name|escape}}menu
      @@ -47,7 +47,7 @@
      - {{$item.name|escaped}} + {{$item.name|escape}}
      •
      diff --git a/view/theme/vier/templates/profile_vcard.tpl b/view/theme/vier/templates/profile_vcard.tpl index 1733969aa8..a464416959 100644 --- a/view/theme/vier/templates/profile_vcard.tpl +++ b/view/theme/vier/templates/profile_vcard.tpl @@ -13,7 +13,7 @@ {{/if}}
      - {{if $profile.addr}}
      {{$profile.addr|escaped}}
      {{/if}} + {{if $profile.addr}}
      {{$profile.addr|escape}}
      {{/if}} {{if $profile.pdesc}}
      {{$profile.pdesc}}
      {{/if}} From 069c92049a99f78baa494f8be3bb014f194e86d1 Mon Sep 17 00:00:00 2001 From: Michael Date: Sun, 25 Nov 2018 23:49:40 +0000 Subject: [PATCH 7/7] Just some misspelling --- view/theme/frio/templates/contact_template.tpl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/view/theme/frio/templates/contact_template.tpl b/view/theme/frio/templates/contact_template.tpl index 1b56a6b62c..604f8d7e5d 100644 --- a/view/theme/frio/templates/contact_template.tpl +++ b/view/theme/frio/templates/contact_template.tpl @@ -9,7 +9,7 @@ {{$contact.name|escape}}
      - {{* For very small displays we use a drobdown menu for contact relating actions *}} + {{* For very small displays we use a dropdown menu for contact relating actions *}}
    {{$u.created}}{{$u.name}}{{$u.name|escape}} {{$u.email}} - - + +
    {{$u.name}} {{$u.name|escape}} {{$u.email}}{{$u.register_date}}
    {{$u.name}}{{$u.name|escape}} {{$u.email}} {{$u.deleted}}
    {{$contact.nickname|escape}}{{$contact.name}}{{$contact.addr}}{{$contact.name|escaped}}{{$contact.addr|escaped}} {{$contact.url}}
    {{$contact.nickname|escape}}{{$contact.name|escaped}}{{$contact.addr|escaped}}{{$contact.name|escape}}{{$contact.addr|escape}} {{$contact.url}}