Replace JQuery .text by .html

- Prevents inserting unescaped HTML in page

diff --git a/view/templates/admin/aside.tpl b/view/templates/admin/aside.tpl
index 0f624d8eb456b5c04df99bd87eb6fee932a6a11d..ecf71d8e56d16138c7c9561fb4fd54975aa52b7a 100644 (file)
--- a/view/templates/admin/aside.tpl
+++ b/view/templates/admin/aside.tpl
@@ -4,7 +4,7 @@
 
                $("nav").bind('nav-update',  function(e,data){
                        var elm = $('#pending-update');
-                       var register = $(data).find('register').text();
+                       var register = $(data).find('register').html();
                        if (register=="0") { register=""; elm.hide();} else { elm.show(); }
                        elm.html(register);
                });

diff --git a/view/templates/event_head.tpl b/view/templates/event_head.tpl
index 8990c6fb25ba0bb81c3c0323ac0576abaae97527..3075408063c9fb66aaeabe6da424f9779d9b3b7c 100644 (file)
--- a/view/templates/event_head.tpl
+++ b/view/templates/event_head.tpl
@@ -168,7 +168,7 @@
                $('#contact_allow, #contact_deny, #group_allow, #group_deny').change(function() {
                        var selstr;
                        $('#contact_allow option:selected, #contact_deny option:selected, #group_allow option:selected, #group_deny option:selected').each( function() {
-                               selstr = $(this).text();
+                               selstr = $(this).html();
                                $('#jot-public').hide();
                        });
                        if(selstr == null) {

diff --git a/view/templates/photos_head.tpl b/view/templates/photos_head.tpl
index 88fd067c8ca3e05f11162917734c58e35d549f3e..1d693e103ce0631404aca69aec17b63fb3fa3c02 100644 (file)
--- a/view/templates/photos_head.tpl
+++ b/view/templates/photos_head.tpl
@@ -10,7 +10,7 @@
                $('#contact_allow, #contact_deny, #group_allow, #group_deny').change(function() {
                        var selstr;
                        $('#contact_allow option:selected, #contact_deny option:selected, #group_allow option:selected, #group_deny option:selected').each( function() {
-                               selstr = $(this).text();
+                               selstr = $(this).html();
                                $('#jot-perms-icon').removeClass('unlock').addClass('lock');
                                $('#jot-public').hide();
                        });

diff --git a/view/templates/settings/head.tpl b/view/templates/settings/head.tpl
index f1229a5aa581dd97ec8c0fb19abc3d0eda3c08d7..6d58e54a6cedab337453faf3d44f3fab9c0ea18e 100644 (file)
--- a/view/templates/settings/head.tpl
+++ b/view/templates/settings/head.tpl
@@ -9,7 +9,7 @@
                $('#contact_allow, #contact_deny, #group_allow, #group_deny').change(function() {
                        var selstr;
                        $('#contact_allow option:selected, #contact_deny option:selected, #group_allow option:selected, #group_deny option:selected').each( function() {
-                               selstr = $(this).text();
+                               selstr = $(this).html();
                                $('#jot-perms-icon').removeClass('unlock').addClass('lock');
                                $('#jot-public').hide();
                        });

diff --git a/view/theme/frio/js/event_edit.js b/view/theme/frio/js/event_edit.js
index a198eef07f8373aeb1c48e814e17353e51bc945d..f7a9c4a76032f21970df1ac86efdacabf20bc54d 100644 (file)
--- a/view/theme/frio/js/event_edit.js
+++ b/view/theme/frio/js/event_edit.js
@@ -23,7 +23,7 @@ $(document).ready(function() {
        $('#contact_allow, #contact_deny, #group_allow, #group_deny').change(function() {
                var selstr;
                $('#contact_allow option:selected, #contact_deny option:selected, #group_allow option:selected, #group_deny option:selected').each( function() {
-                       selstr = $(this).text();
+                       selstr = $(this).html();
                        $('#jot-public').hide();
                });
                if (selstr == null) {

diff --git a/view/theme/frio/js/mod_photos.js b/view/theme/frio/js/mod_photos.js
index 692a7057f4c07a9a45dab280d74bfbef33c29e84..c75a997caba12ce2287dcdff9a71246acca776f4 100644 (file)
--- a/view/theme/frio/js/mod_photos.js
+++ b/view/theme/frio/js/mod_photos.js
@@ -5,7 +5,7 @@ $(document).ready(function() {
        $('#contact_allow, #contact_deny, #group_allow, #group_deny').change(function() {
                var selstr;
                $('#contact_allow option:selected, #contact_deny option:selected, #group_allow option:selected, #group_deny option:selected').each( function() {
-                       selstr = $(this).text();
+                       selstr = $(this).html();
                        $('#jot-perms-icon').removeClass('unlock').addClass('lock');
                        $('#jot-public').hide();
                });

diff --git a/view/theme/frio/js/modal.js b/view/theme/frio/js/modal.js
index a088b08e349efe5bab8247570c8a585e536ad196..241cfd4cea3f607ca259e335de3dacbeaa8ab647 100644 (file)
--- a/view/theme/frio/js/modal.js
+++ b/view/theme/frio/js/modal.js
@@ -192,12 +192,12 @@ function loadModalTitle() {
        var title = "";
 
        // Get the text of the first element with "heading" class.
-       title = $("#modal-body .heading").first().text();
+       title = $("#modal-body .heading").first().html();
 
        // for event modals we need some speacial handling
        if($("#modal-body .event-wrapper .event-summary").length) {
                title = '<i class="fa fa-calendar" aria-hidden="true"></i>&nbsp;';
-               var eventsum = $("#modal-body .event-wrapper .event-summary").text();
+               var eventsum = $("#modal-body .event-wrapper .event-summary").html();
                title = title + eventsum;
        }
 

diff --git a/view/theme/frio/js/theme.js b/view/theme/frio/js/theme.js
index 99ec88de1aacb0ee30dedfeaeaf90d3ba7aa98df..b630739668e042bea6f72eda73067637b2d49605 100644 (file)
--- a/view/theme/frio/js/theme.js
+++ b/view/theme/frio/js/theme.js
@@ -146,7 +146,7 @@ $(document).ready(function(){
        if( $(".search-content-wrapper").length ) {
                // get the text of the heading (we catch the plain text because we don't
                // want to have a h4 heading in the navbar
-               var searchText = $(".section-title-wrapper > h2").text();
+               var searchText = $(".section-title-wrapper > h2").html();
                // insert the plain text in a <h4> heading and give it a class
                var newText = '<h4 class="search-heading">'+searchText+'</h4>';
                // append the new heading to the navbar
@@ -208,7 +208,7 @@ $(document).ready(function(){
                // get the heading element
                var heading = $(".network-content-wrapper > .section-title-wrapper > h2");
                // get the text of the heading
-               var headingContent = heading.text();
+               var headingContent = heading.html();
                // create a new element with the content of the heading
                var newText = '<h4 class="heading" data-toggle="tooltip" title="'+headingContent+'">'+headingContent+'</h4>';
                // remove the old heading element
@@ -221,7 +221,7 @@ $(document).ready(function(){
                // get the heading element
                var heading = $(".community-content-wrapper > h3").first();
                // get the text of the heading
-               var headingContent = heading.text();
+               var headingContent = heading.html();
                // create a new element with the content of the heading
                var newText = '<h4 class="heading">'+headingContent+'</h4>';
                // remove the old heading element
@@ -790,7 +790,7 @@ function bin2hex (s) {
 // Dropdown menus with the class "dropdown-head" will display the active tab
 // as button text
 function toggleDropdownText(elm) {
-               $(elm).closest(".dropdown").find('.btn').html($(elm).text() + ' <span class="caret"></span>');
+               $(elm).closest(".dropdown").find('.btn').html($(elm).html() + ' <span class="caret"></span>');
                $(elm).closest(".dropdown").find('.btn').val($(elm).data('value'));
                $(elm).closest("ul").children("li").show();
                $(elm).parent("li").hide();

diff --git a/view/theme/frio/templates/admin/aside.tpl b/view/theme/frio/templates/admin/aside.tpl
index 0ba58e5aecaada0ada71d257aa91594c3dcf0ac2..b02f5f6149f1ea52b4483d662d9b8f67e2ee903d 100644 (file)
--- a/view/theme/frio/templates/admin/aside.tpl
+++ b/view/theme/frio/templates/admin/aside.tpl
@@ -3,9 +3,10 @@
        $(function(){
                $("nav").bind('nav-update', function(e,data){
                        var elm = $('#pending-update');
-                       var register = $(data).find('register').text();
-                       if (register=="0") { register = ""; }
-                       elm.html(register);
+                       var register = parseInt($(data).find('register').text());
+                       if (register > 0) {
+                               elm.html(register);
+                       }
                });
        });
 </script>

diff --git a/view/theme/quattro/js/quattro.js b/view/theme/quattro/js/quattro.js
index 89407569b7f985888eb414b02329c0c6442118a4..e91794febad852969d2b6736d95692e9f03a7dba 100644 (file)
--- a/view/theme/quattro/js/quattro.js
+++ b/view/theme/quattro/js/quattro.js
@@ -2,8 +2,8 @@
 $(document).ready(function(){
        $('nav').bind('nav-update', function(e,data){
                var notifCount = $(data).find('notif').attr('count');
-               var intro = $(data).find('intro').text();
-               var mail = $(data).find('mail').text();
+               var intro = parseInt($(data).find('intro').text());
+               var mail = parseInt($(data).find('mail').text());
 
                $(".tool .notify").removeClass("on");
                $(data).find("group").each(function() {

diff --git a/view/theme/smoothly/templates/jot-header.tpl b/view/theme/smoothly/templates/jot-header.tpl
index 3a70a5a9cc259ec8cb3118daa4568487a3ceed76..71e54246b31056c306a37e48774d41b92d18753e 100644 (file)
--- a/view/theme/smoothly/templates/jot-header.tpl
+++ b/view/theme/smoothly/templates/jot-header.tpl
@@ -86,7 +86,7 @@ function enableOnUser(){
                $('#contact_allow, #contact_deny, #group_allow, #group_deny').change(function() {
                        var selstr;
                        $('#contact_allow option:selected, #contact_deny option:selected, #group_allow option:selected, #group_deny option:selected').each( function() {
-                               selstr = $(this).text();
+                               selstr = $(this).html();
                                $('#jot-perms-icon').removeClass('unlock').addClass('lock');
                                $('#jot-public').hide();
                                $('.profile-jot-net input').attr('disabled', 'disabled');

diff --git a/view/theme/vier/templates/event_head.tpl b/view/theme/vier/templates/event_head.tpl
index 75f6f4b046075a29d8bcee14a34a72f1d9eb1c01..2c7b3070a74e5c4225205e3bfd1d0e3493136348 100644 (file)
--- a/view/theme/vier/templates/event_head.tpl
+++ b/view/theme/vier/templates/event_head.tpl
@@ -170,7 +170,7 @@
                $('#contact_allow, #contact_deny, #group_allow, #group_deny').change(function() {
                        var selstr;
                        $('#contact_allow option:selected, #contact_deny option:selected, #group_allow option:selected, #group_deny option:selected').each( function() {
-                               selstr = $(this).text();
+                               selstr = $(this).html();
                                $('#jot-public').hide();
                        });
                        if(selstr == null) {