Remove escaping exception for form field values

- This could allow code injection from a malicious query leading to a form page
- Thanks to Laura Pîrcălăboiu for the report

diff --git a/view/templates/field_combobox.tpl b/view/templates/field_combobox.tpl
index 3e6e06052fa857997d2e23b6f03922b131960fa4..b62bf2dbac8fe25c752523e8374c025b7cfc4335 100644 (file)
--- a/view/templates/field_combobox.tpl
+++ b/view/templates/field_combobox.tpl
@@ -1,4 +1,3 @@
-       
        <div class='field combobox'>
                <label for='id_{{$field.0}}' id='id_{{$field.0}}_label'>{{$field.1}}</label>
                {{* html5 don't work on Chrome, Safari and IE9
@@ -6,13 +5,13 @@
                <datalist id="data_{{$field.0}}">
                   {{foreach $field.4 as $opt=>$val}}<option value="{{$val}}">{{/foreach}}
                </datalist> *}}
-               
-               <input id="id_{{$field.0}}" type="text" value="{{$field.2 nofilter}}" aria-describedby='{{$field.0}}_tip'>
+
+               <input id="id_{{$field.0}}" type="text" value="{{$field.2}}" aria-describedby='{{$field.0}}_tip'>
                <select id="select_{{$field.0}}" onChange="$('#id_{{$field.0}}').val($(this).val())">
                        <option value="">{{$field.5}}</option>
                        {{foreach $field.4 as $opt=>$val}}<option value="{{$val}}">{{$val}}</option>{{/foreach}}
                </select>
-               
+
                {{if $field.3}}
                <span class="field_help" role="tooltip" id="{{$field.0}}_tip">{{$field.3 nofilter}}</span>
                {{/if}}

diff --git a/view/templates/field_openid.tpl b/view/templates/field_openid.tpl
index 3c7d02bb8e02a36e69d0f638f6a749e6481811a3..033a1f8e5029c543ccfbd00b4e5c5ff8b7115fa3 100644 (file)
--- a/view/templates/field_openid.tpl
+++ b/view/templates/field_openid.tpl
@@ -1,7 +1,6 @@
-       
        <div class='field input openid' id='wrapper_{{$field.0}}'>
                <label for='id_{{$field.0}}'>{{$field.1}}</label>
-               <input name='{{$field.0}}' id='id_{{$field.0}}' type="text" value="{{$field.2 nofilter}}" {{if $field.4}} readonly="readonly" {{/if}} aria-describedby='{{$field.0}}_tip'>
+               <input name='{{$field.0}}' id='id_{{$field.0}}' type="text" value="{{$field.2}}" {{if $field.4}} readonly="readonly" {{/if}} aria-describedby='{{$field.0}}_tip'>
                {{if $field.3}}
                <span class="field_help" role="tooltip" id="{{$field.0}}_tip">{{$field.3 nofilter}}</span>
                {{/if}}

diff --git a/view/templates/field_password.tpl b/view/templates/field_password.tpl
index 07241fb11baa988a73763a9777ffcde7b08af879..57149fe52dbad07245e3e2e6822c426752778767 100644 (file)
--- a/view/templates/field_password.tpl
+++ b/view/templates/field_password.tpl
@@ -1,7 +1,6 @@
-       
        <div class="field password" id="wrapper_{{$field.0}}">
                <label for="id_{{$field.0}}">{{$field.1}}{{if $field.4}} <span class="required" title="{{$field.4}}">*</span>{{/if}}</label>
-               <input type="password" name="{{$field.0}}" id="id_{{$field.0}}" value="{{$field.2 nofilter}}"{{if $field.4}} required{{/if}}{{if $field.5 eq "autofocus"}} autofocus{{elseif $field.5}} {{$field.5}}{{/if}}{{if $field.6}} pattern="(($field.6}}"{{/if}} aria-describedby="{{$field.0}}_tip">
+               <input type="password" name="{{$field.0}}" id="id_{{$field.0}}" value="{{$field.2}}"{{if $field.4}} required{{/if}}{{if $field.5 eq "autofocus"}} autofocus{{elseif $field.5}} {{$field.5}}{{/if}}{{if $field.6}} pattern="(($field.6}}"{{/if}} aria-describedby="{{$field.0}}_tip">
                {{if $field.3}}
                <span class="field_help" role="tooltip" id="{{$field.0}}_tip">{{$field.3 nofilter}}</span>
                {{/if}}

diff --git a/view/theme/frio/templates/field_colorinput.tpl b/view/theme/frio/templates/field_colorinput.tpl
index 2c530a2e4616879a949dc846c20c0b95a335d8fb..f812ff234b59e9a293a69625f8e999b01a25a93b 100644 (file)
--- a/view/theme/frio/templates/field_colorinput.tpl
+++ b/view/theme/frio/templates/field_colorinput.tpl
@@ -1,9 +1,8 @@
-
 <div class="form-group field input color">
        <label for="id_{{$field.0}}" id="label_{{$field.0}}">{{$field.1}}{{if $field.4}} <span class="required" title="{{$field.4}}">*</span>{{/if}}</label>
        <div class="input-group" id="{{$field.0}}">
                <span class="input-group-addon"><i></i></span>
-               <input class="form-control color" name="{{$field.0}}" id="id_{{$field.0}}" type="text" value="{{$field.2 nofilter}}"{{if $field.4}} required{{/if}} aria-describedby="{{$field.0}}_tip">
+               <input class="form-control color" name="{{$field.0}}" id="id_{{$field.0}}" type="text" value="{{$field.2}}"{{if $field.4}} required{{/if}} aria-describedby="{{$field.0}}_tip">
        </div>
        {{if $field.3}}
        <span class="help-block" id="{{$field.0}}_tip" role="tooltip">{{$field.3 nofilter}}</span>

diff --git a/view/theme/frio/templates/field_fileinput.tpl b/view/theme/frio/templates/field_fileinput.tpl
index dd6825f2ee1917898eaa366f4b89a3054ff7825d..96ae45596e94b62647cc742ecb95532ef97bf0b9 100644 (file)
--- a/view/theme/frio/templates/field_fileinput.tpl
+++ b/view/theme/frio/templates/field_fileinput.tpl
@@ -1,8 +1,7 @@
-
 <div class="form-group field input file">
        <label for="id_{{$field.0}}" id="label_{{$field.0}}">{{$field.1}}{{if $field.4}} <span class="required" title="{{$field.4}}">*</span>{{/if}}</label>
        <div class="input-group" id="{{$field.0}}">
-               <input class="form-control file" name="{{$field.0}}" id="id_{{$field.0}}" type="text" value="{{$field.2 nofilter}}"{{if $field.4}} required{{/if}} aria-describedby="{{$field.0}}_tip">
+               <input class="form-control file" name="{{$field.0}}" id="id_{{$field.0}}" type="text" value="{{$field.2}}"{{if $field.4}} required{{/if}} aria-describedby="{{$field.0}}_tip">
                <span class="input-group-addon image-select"><i class="fa fa-picture-o"></i></span>
        </div>
        {{if $field.3}}

diff --git a/view/theme/frio/templates/field_openid.tpl b/view/theme/frio/templates/field_openid.tpl
index bae9cb4fc417ac1b0b6a2625119a376f6aebc9e3..c36dbfabca1e740425cc2d985c7dfd8cc3d559bb 100644 (file)
--- a/view/theme/frio/templates/field_openid.tpl
+++ b/view/theme/frio/templates/field_openid.tpl
@@ -1,7 +1,6 @@
-
 <div id="id_{{$field.0}}_wrapper" class="form-group field input openid">
        <label for="id_{{$field.0}}" id="label_{{$field.0}}">{{$field.1}}</label>
-       <input class="form-control" name="{{$field.0}}" id="id_{{$field.0}}" type="text" value="{{$field.2 nofilter}}" {{if $field.4}} readonly="readonly" {{/if}} aria-describedby="{{$field.0}}_tip">
+       <input class="form-control" name="{{$field.0}}" id="id_{{$field.0}}" type="text" value="{{$field.2}}" {{if $field.4}} readonly="readonly" {{/if}} aria-describedby="{{$field.0}}_tip">
        {{if $field.3}}
        <span class="help-block" id="{{$field.0}}_tip" role="tooltip">{{$field.3 nofilter}}</span>
        {{/if}}

diff --git a/view/theme/frio/templates/field_password.tpl b/view/theme/frio/templates/field_password.tpl
index 25a7d0c4cecfcbac625006c2adb42a0f907a9f7f..0fb27ca88fcebe4e3a6ec8d6d9a27ef64e5538c6 100644 (file)
--- a/view/theme/frio/templates/field_password.tpl
+++ b/view/theme/frio/templates/field_password.tpl
@@ -1,7 +1,6 @@
-
 <div id="id_{{$field.0}}_wrapper" class="form-group field input password">
        <label for="id_{{$field.0}}" id="label_{{$field.0}}">{{$field.1}}{{if $field.4}} <span class="required" title="{{$field.4}}">*</span>{{/if}}</label>
-       <input class="form-control" name="{{$field.0}}" id="id_{{$field.0}}" type="password" value="{{$field.2 nofilter}}" {{if $field.4}} required{{/if}}{{if $field.5 eq "autofocus"}} autofocus{{elseif $field.5}} {{$field.5}}{{/if}}{{if $field.6}} pattern="{{$field.6}}"{{/if}} aria-describedby="{{$field.0}}_tip">
+       <input class="form-control" name="{{$field.0}}" id="id_{{$field.0}}" type="password" value="{{$field.2}}" {{if $field.4}} required{{/if}}{{if $field.5 eq "autofocus"}} autofocus{{elseif $field.5}} {{$field.5}}{{/if}}{{if $field.6}} pattern="{{$field.6}}"{{/if}} aria-describedby="{{$field.0}}_tip">
        {{if $field.3}}
        <span class="help-block" id="{{$field.0}}_tip" role="tooltip">{{$field.3 nofilter}}</span>
        {{/if}}