From: Michael Date: Sun, 25 Nov 2018 18:56:26 +0000 (+0000) Subject: We are now escaping many template fields X-Git-Url: https://git.mxchange.org/?a=commitdiff_plain;h=4f9f86e310a433d56622527be002ba2a474c5240;p=friendica.git We are now escaping many template fields --- diff --git a/src/Module/Contact.php b/src/Module/Contact.php index ec7e896925..66e8c97fdf 100644 --- a/src/Module/Contact.php +++ b/src/Module/Contact.php @@ -85,7 +85,7 @@ class Contact extends BaseModule /// @TODO Add nice spaces $vcard_widget = Renderer::replaceMacros(Renderer::getMarkupTemplate('vcard-widget.tpl'), [ - '$name' => htmlentities($contact['name']), + '$name' => $contact['name'], '$photo' => $contact['photo'], '$url' => Model\Contact::MagicLink($contact['url']), '$addr' => defaults($contact, 'addr', ''), @@ -639,7 +639,7 @@ class Contact extends BaseModule '$ffi_keyword_blacklist' => $contact['ffi_keyword_blacklist'], '$ffi_keyword_blacklist' => ['ffi_keyword_blacklist', L10n::t('Blacklisted keywords'), $contact['ffi_keyword_blacklist'], L10n::t('Comma separated list of keywords that should not be converted to hashtags, when "Fetch information and keywords" is selected')], '$photo' => $contact['photo'], - '$name' => htmlentities($contact['name']), + '$name' => $contact['name'], '$dir_icon' => $dir_icon, '$sparkle' => $sparkle, '$url' => $url, @@ -1033,14 +1033,14 @@ class Contact extends BaseModule 'alt_text' => $alt_text, 'dir_icon' => $dir_icon, 'thumb' => ProxyUtils::proxifyUrl($rr['thumb'], false, ProxyUtils::SIZE_THUMB), - 'name' => htmlentities($rr['name']), - 'username' => htmlentities($rr['name']), + 'name' => $rr['name'], + 'username' => $rr['name'], 'account_type' => Model\Contact::getAccountType($rr), 'sparkle' => $sparkle, 'itemurl' => defaults($rr, 'addr', $rr['url']), 'url' => $url, 'network' => ContactSelector::networkToName($rr['network'], $rr['url']), - 'nick' => htmlentities($rr['nick']), + 'nick' => $rr['nick'], ]; } diff --git a/src/Object/Post.php b/src/Object/Post.php index e7a9e6b020..50d903f025 100644 --- a/src/Object/Post.php +++ b/src/Object/Post.php @@ -213,7 +213,7 @@ class Post extends BaseObject $filer = (($conv->getProfileOwner() == local_user() && ($item['uid'] != 0)) ? L10n::t("save to folder") : false); - $profile_name = htmlentities($item['author-name']); + $profile_name = $item['author-name']; if (!empty($item['author-link']) && empty($item['author-name'])) { $profile_name = $item['author-link']; } @@ -377,7 +377,7 @@ class Post extends BaseObject 'isevent' => $isevent, 'attend' => $attend, 'linktitle' => L10n::t('View %s\'s profile @ %s', $profile_name, $item['author-link']), - 'olinktitle' => L10n::t('View %s\'s profile @ %s', htmlentities($this->getOwnerName()), $item['owner-link']), + 'olinktitle' => L10n::t('View %s\'s profile @ %s', $this->getOwnerName(), $item['owner-link']), 'to' => L10n::t('to'), 'via' => L10n::t('via'), 'wall' => L10n::t('Wall-to-Wall'), @@ -399,7 +399,7 @@ class Post extends BaseObject 'shiny' => $shiny, 'owner_url' => $this->getOwnerUrl(), 'owner_photo' => $a->removeBaseURL(ProxyUtils::proxifyUrl($item['owner-avatar'], false, ProxyUtils::SIZE_THUMB)), - 'owner_name' => htmlentities($owner_name_e), + 'owner_name' => $owner_name_e, 'plink' => Item::getPlink($item), 'edpost' => $edpost, 'isstarred' => $isstarred, diff --git a/view/templates/admin/addon_details.tpl b/view/templates/admin/addon_details.tpl index fb908b7058..96b26d2d09 100644 --- a/view/templates/admin/addon_details.tpl +++ b/view/templates/admin/addon_details.tpl @@ -18,7 +18,7 @@

{{if $screenshot}} - {{$screenshot.1}} + {{$screenshot.1|escape}} {{/if}} {{if $admin_form}} diff --git a/view/templates/admin/contactblock.tpl b/view/templates/admin/contactblock.tpl index 152550f017..c9bfc2efd0 100644 --- a/view/templates/admin/contactblock.tpl +++ b/view/templates/admin/contactblock.tpl @@ -32,10 +32,10 @@ {{foreach $contacts as $contact}} - {{$contact.nickname}} + {{$contact.nickname|escape}} {{$contact.name}} {{$contact.addr}} - {{$contact.url}} + {{$contact.url}} {{/foreach}} diff --git a/view/templates/admin/users.tpl b/view/templates/admin/users.tpl index b2b0d615a4..f06b0f9734 100644 --- a/view/templates/admin/users.tpl +++ b/view/templates/admin/users.tpl @@ -35,8 +35,8 @@ {{$u.email}} - - + + @@ -79,8 +79,8 @@ {{foreach $users as $u}} - {{$u.nickname}} - {{$u.name}} + {{$u.nickname|escape}} + {{$u.name}} {{$u.email}} {{$u.register_date}} {{$u.login_date}} @@ -94,8 +94,8 @@ {{/if}} {{if $u.is_deletable}} - - + + {{else}}   {{/if}} @@ -122,8 +122,8 @@ {{foreach $deleted as $u}} - {{$u.nickname}} - {{$u.name}} + {{$u.nickname|escape}} + {{$u.name}} {{$u.email}} {{$u.register_date}} {{$u.login_date}} diff --git a/view/templates/hovercard.tpl b/view/templates/hovercard.tpl index 7bf37e74b3..74f2700052 100644 --- a/view/templates/hovercard.tpl +++ b/view/templates/hovercard.tpl @@ -3,12 +3,12 @@
- {{$profile.name}} + {{$profile.name|escape}}
-

{{$profile.name}}

{{if $profile.account_type}}{{$profile.account_type}}{{/if}} +

{{$profile.name|escape}}

{{if $profile.account_type}}{{$profile.account_type}}{{/if}}
{{$profile.addr}} @@ -21,13 +21,13 @@ {{* here are the differnt actions like privat message, poke, delete and so on *}} {{* @todo we have two different photo menus one for contacts and one for items at the network stream. We currently use the contact photo menu, so the items options are missing We need to move them *}}
- {{if $profile.actions.pm}}{{/if}} - {{if $profile.actions.poke}}{{/if}} + {{if $profile.actions.pm}}{{/if}} + {{if $profile.actions.poke}}{{/if}}
- {{if $profile.actions.network}}{{/if}} - {{if $profile.actions.edit}}{{/if}} - {{if $profile.actions.follow}}{{/if}} + {{if $profile.actions.network}}{{/if}} + {{if $profile.actions.edit}}{{/if}} + {{if $profile.actions.follow}}{{/if}}
diff --git a/view/templates/profile_vcard.tpl b/view/templates/profile_vcard.tpl index b56dd607ce..6f8e86b299 100644 --- a/view/templates/profile_vcard.tpl +++ b/view/templates/profile_vcard.tpl @@ -1,16 +1,16 @@
-
{{$profile.name}}
+
{{$profile.name|escape}}
{{if $profile.addr}}
{{$profile.addr}}
{{/if}} {{if $profile.pdesc}}
{{$profile.pdesc}}
{{/if}} {{if $profile.picdate}} -
{{$profile.name}}
+
{{$profile.name|escape}}
{{else}} -
{{$profile.name}}
+
{{$profile.name|escape}}
{{/if}} {{if $account_type}}{{/if}} {{if $profile.network_name}}
{{$network}}
{{$profile.network_name}}
{{/if}} diff --git a/view/templates/vcard-widget.tpl b/view/templates/vcard-widget.tpl index 47b64b68da..eed94193f5 100644 --- a/view/templates/vcard-widget.tpl +++ b/view/templates/vcard-widget.tpl @@ -1,14 +1,14 @@
-
{{$name}}
- {{if $addr}}
{{$addr}}
{{/if}} +
{{$name|escape}}
+ {{if $addr}}
{{$addr|escape}}
{{/if}} {{if $pdesc}}
{{$pdesc}}
{{/if}} {{if $url}} -
{{$name}}
+
{{$name|escape}}
{{else}} -
{{$name}}
+
{{$name|escape}}
{{/if}} - {{if $account_type}}{{/if}} + {{if $account_type}}{{/if}} {{if $network_name}}
{{$network}}
{{$network_name}}
{{/if}}
diff --git a/view/templates/wall_thread.tpl b/view/templates/wall_thread.tpl index a82efa7d1c..63a8364f88 100644 --- a/view/templates/wall_thread.tpl +++ b/view/templates/wall_thread.tpl @@ -19,15 +19,15 @@ {{if $item.owner_url}}
- {{$item.owner_name}} + {{$item.owner_name|escape}}
-
{{$item.wall}}
+
{{$item.wall|escape}}
{{/if}}
- {{$item.name}} + {{$item.name|escape}} menu
    @@ -38,7 +38,7 @@
- {{if $item.lock}}
{{$item.lock}}
+ {{if $item.lock}}
{{$item.lock|escape}}
{{else}}
{{/if}}
{{$item.location}}
diff --git a/view/templates/widget_forumlist.tpl b/view/templates/widget_forumlist.tpl index 32da71f816..da30967cd6 100644 --- a/view/templates/widget_forumlist.tpl +++ b/view/templates/widget_forumlist.tpl @@ -21,8 +21,8 @@ function showHideForumlist() { {{if $forum.id <= $visible_forums}} @@ -31,8 +31,8 @@ function showHideForumlist() { {{if $forum.id > $visible_forums}} diff --git a/view/theme/duepuntozero/templates/profile_vcard.tpl b/view/theme/duepuntozero/templates/profile_vcard.tpl index 186b7e4490..505cf560e3 100644 --- a/view/theme/duepuntozero/templates/profile_vcard.tpl +++ b/view/theme/duepuntozero/templates/profile_vcard.tpl @@ -1,12 +1,12 @@
-
{{$profile.name}}
+
{{$profile.name|escape}}
{{if $profile.addr}}
{{$profile.addr}}
{{/if}} {{if $profile.pdesc}}
{{$profile.pdesc}}
{{/if}} -
{{$profile.name}}
+
{{$profile.name|escape}}
{{if $account_type}}{{/if}} diff --git a/view/theme/frio/templates/admin/addons.tpl b/view/theme/frio/templates/admin/addons.tpl index 220abdc2c4..38efb62bd4 100644 --- a/view/theme/frio/templates/admin/addons.tpl +++ b/view/theme/frio/templates/admin/addons.tpl @@ -12,7 +12,7 @@
  • - {{$p.2.name}} - {{$p.2.version}} + {{$p.2.name|escape}} - {{$p.2.version}} {{if $p.2.experimental}} {{$experimental}} {{/if}}{{if $p.2.unsupported}} {{$unsupported}} {{/if}}
    {{$p.2.description}}
    • diff --git a/view/theme/frio/templates/admin/contactblock.tpl b/view/theme/frio/templates/admin/contactblock.tpl index 3173c238b6..3ac9a25173 100644 --- a/view/theme/frio/templates/admin/contactblock.tpl +++ b/view/theme/frio/templates/admin/contactblock.tpl @@ -67,9 +67,9 @@
    - {{$contact.nickname}} - {{$contact.name}} - {{$contact.url}} + {{$contact.nickname|escape}} + {{$contact.name|escape}} + {{$contact.url|escape}} {{/foreach}} @@ -78,7 +78,7 @@ {{* Checkbox to select all blocked contacts *}}
    - +
    diff --git a/view/theme/frio/templates/admin/queue.tpl b/view/theme/frio/templates/admin/queue.tpl index dde3863999..3ebe89052e 100644 --- a/view/theme/frio/templates/admin/queue.tpl +++ b/view/theme/frio/templates/admin/queue.tpl @@ -13,12 +13,12 @@ {{foreach $entries as $e}} - {{$e.id}} - {{$e.name}} - {{$e.nurl}} - {{$e.network}} - {{$e.created}} - {{$e.last}} + {{$e.id|escape}} + {{$e.name|escape}} + {{$e.nurl|escape}} + {{$e.network|escape}} + {{$e.created|escape}} + {{$e.last|escape}} {{/foreach}} diff --git a/view/theme/frio/templates/admin/summary.tpl b/view/theme/frio/templates/admin/summary.tpl index 66afda721b..c2bbf49a70 100644 --- a/view/theme/frio/templates/admin/summary.tpl +++ b/view/theme/frio/templates/admin/summary.tpl @@ -54,14 +54,14 @@ {{* The Friendica version. *}}
    -
    {{$version.0}}
    -
    {{$platform}} '{{$codename}}' {{$version.1}} - {{$build}}
    +
    {{$version.0|escape}}
    +
    {{$platform}} '{{$codename|escape}}' {{$version.1|escape}} - {{$build|escape}}
    {{* Server Settings. *}}
    -
    {{$serversettings.label}}
    +
    {{$serversettings.label|escape}}
    diff --git a/view/theme/frio/templates/admin/users.tpl b/view/theme/frio/templates/admin/users.tpl index 92ef9be6fa..031ffd0a47 100644 --- a/view/theme/frio/templates/admin/users.tpl +++ b/view/theme/frio/templates/admin/users.tpl @@ -46,11 +46,11 @@ - + {{if $u.note}} @@ -145,8 +145,8 @@   {{/if}} - - + + {{if $order_users == $th_users.2.1}} @@ -169,18 +169,18 @@ {{if $u.page_flags_raw==3}}fa-heart{{/if}} {{* PAGE_FREELOVE *}} {{if $u.page_flags_raw==4}}fa-rss{{/if}} {{* PAGE_BLOG *}} {{if $u.page_flags_raw==5}}fa-user-secret{{/if}} {{* PAGE_PRVGROUP *}} - " title="{{$u.page_flags}}"> + " title="{{$u.page_flags|escape}}"> {{if $u.page_flags_raw==0 && $u.account_type_raw > 0}} {{/if}} - {{if $u.is_admin}}{{/if}} - {{if $u.account_expired}}{{/if}} + {{if $u.is_admin}}{{/if}} + {{if $u.account_expired}}{{/if}} {{/if}} @@ -229,7 +229,7 @@ {{/if}} - + {{else}} @@ -297,8 +297,8 @@ {{foreach $deleted as $u}} - - + + diff --git a/view/theme/frio/templates/comment_item.tpl b/view/theme/frio/templates/comment_item.tpl index 4ef5f2caa1..804d07ac01 100644 --- a/view/theme/frio/templates/comment_item.tpl +++ b/view/theme/frio/templates/comment_item.tpl @@ -33,37 +33,37 @@ {{/if}}
    • -
    • -
    • -
    • -
    • -
    • -
    • -
      • diff --git a/view/theme/frio/templates/common_tabs.tpl b/view/theme/frio/templates/common_tabs.tpl index 76c6db0398..207ffefcb9 100644 --- a/view/theme/frio/templates/common_tabs.tpl +++ b/view/theme/frio/templates/common_tabs.tpl @@ -6,7 +6,7 @@
      • @@ -31,7 +31,7 @@ @@ -35,35 +35,35 @@
      - {{$contact_status}} + {{$contact_status|escape}} {{* Block with status information about the contact *}}
        - {{if $relation_text}}
      • {{$relation_text}}
        • {{/if}} - {{if $nettype}}
      • {{$nettype}}
        • {{/if}} + {{if $relation_text}}
      • {{$relation_text|escape}}
        • {{/if}} + {{if $nettype}}
      • {{$nettype|escape}}
        • {{/if}} {{if $poll_enabled}} -
      • {{$lastupdtext}} {{$last_update}}
        +
      • {{$lastupdtext|escape}} {{$last_update|escape}}
        {{if $poll_interval}}
        - {{$updpub}} {{$poll_interval}} + {{$updpub|escape}} {{$poll_interval}} {{/if}}
        • {{/if}} - {{if $lost_contact}}
      • {{$lost_contact}}
        • {{/if}} - {{if $insecure}}
      • {{$insecure}}
        • {{/if}} - {{if $blocked && !$pending}}
      • {{$blocked}}
        • {{/if}} - {{if $pending}}
      • {{$pending}}
        • {{/if}} - {{if $ignored}}
      • {{$ignored}}
        • {{/if}} - {{if $archived}}
      • {{$archived}}
        • {{/if}} + {{if $lost_contact}}
      • {{$lost_contact|escape}}
        • {{/if}} + {{if $insecure}}
      • {{$insecure|escape}}
        • {{/if}} + {{if $blocked && !$pending}}
      • {{$blocked|escape}}
        • {{/if}} + {{if $pending}}
      • {{$pending|escape}}
        • {{/if}} + {{if $ignored}}
      • {{$ignored|escape}}
        • {{/if}} + {{if $archived}}
      • {{$archived|escape}}
        • {{/if}}
      {{* End of contact-edit-status-wrapper *}} @@ -83,38 +83,38 @@
      -
      {{$profileurllabel}}
      {{$profileurl}} +
      {{$profileurllabel|escape}}
      {{$profileurl|escape}}
      {{if $location}}
      -
      {{$location_label}}
      -
      {{$location}}
      +
      {{$location_label|escape}}
      +
      {{$location|escape}}
      {{/if}} {{if $xmpp}}
      -
      {{$xmpp_label}}
      -
      {{$xmpp}}
      +
      {{$xmpp_label|escape}}
      +
      {{$xmpp|escape}}
      {{/if}} {{if $keywords}}
      -
      {{$keywords_label}}
      -
      {{$keywords}}
      +
      {{$keywords_label|escape}}
      +
      {{$keywords|escape}}
      {{/if}} {{if $about}}
      -
      {{$about_label}}
      -
      {{$about}}
      +
      {{$about_label|escape}}
      +
      {{$about|escape}}
      {{/if}}
      @@ -127,14 +127,14 @@
      - + {{include file="field_checkbox.tpl" field=$notify}} {{if $fetch_further_information}} @@ -144,7 +144,7 @@ {{include file="field_checkbox.tpl" field=$hidden}}
      - +
      @@ -157,7 +157,7 @@ @@ -167,11 +167,11 @@ {{include file="field_textarea.tpl" field=$cinfo}}
      - +
      {{if $reason}} -

      {{$lbl_info2}}

      +

      {{$lbl_info2|escape}}

      {{$reason}}

      {{/if}} @@ -184,7 +184,7 @@ @@ -192,7 +192,7 @@
      {{if $profile_select}}
      -

      {{$lbl_vis2}}

      +

      {{$lbl_vis2|escape}}

      {{$profile_select}} @@ -201,7 +201,7 @@ {{/if}}
      - +
      diff --git a/view/theme/frio/templates/contact_template.tpl b/view/theme/frio/templates/contact_template.tpl index e1c0a77009..4f07ad2b1d 100644 --- a/view/theme/frio/templates/contact_template.tpl +++ b/view/theme/frio/templates/contact_template.tpl @@ -6,14 +6,14 @@
      {{* For very small displays we use a drobdown menu for contact relating actions *}} {{/if}} {{if $contact.photo_menu.poke}} - {{/if}} {{if $contact.photo_menu.network}} - + {{/if}} {{if $contact.photo_menu.edit}} - + {{/if}} {{if $contact.photo_menu.drop}} - {{/if}} {{if $contact.photo_menu.follow}} - + {{/if}} {{if $contact.photo_menu.hide}} - + {{/if}} @@ -84,7 +84,7 @@ {{* The button to add or remove contacts from a contact group - group edit page *}} {{if $contact.change_member}}
      - {/if} {if $photo_menu.poke} - {/if} {if $photo_menu.network} - + {/if} {if $photo_menu.edit} - + {/if} {if $photo_menu.drop} - + {/if} {if $photo_menu.follow} - + {/if} @@ -207,7 +207,7 @@ We use this part to filter the contacts with jquery.textcomplete *}} {{* The button to add or remove contacts from a contact group - group edit page *}} {if $contact.change_member}
      - {{/if}} - {{if $event.copy}}{{/if}} - {{if $event.drop}}{{/if}} - {{if $event.item.plink}}{{/if}} + {{if $event.edit}}{{/if}} + {{if $event.copy}}{{/if}} + {{if $event.drop}}{{/if}} + {{if $event.item.plink}}{{/if}}
      diff --git a/view/theme/frio/templates/event_stream_item.tpl b/view/theme/frio/templates/event_stream_item.tpl index 87c2e70cad..58f39a0ee1 100644 --- a/view/theme/frio/templates/event_stream_item.tpl +++ b/view/theme/frio/templates/event_stream_item.tpl @@ -17,16 +17,16 @@ {{if $location.map}}{{/if}}
      - {{$start_short}} - {{if $finish}} - {{if $same_date}}{{$end_time}}{{else}}{{$end_short}}{{/if}}{{/if}} + {{$start_short}} + {{if $finish}} - {{if $same_date}}{{$end_time}}{{else}}{{$end_short}}{{/if}}{{/if}} {{if $location.name}} - {{$location.name}} + {{$location.name|escape}} {{/if}}
      - {{$author_name}} + {{$author_name|escape}}
      {{if $location.map}}
      {{$location.map}}
      diff --git a/view/theme/frio/templates/events_js.tpl b/view/theme/frio/templates/events_js.tpl index a4ca9004cd..3866282a33 100644 --- a/view/theme/frio/templates/events_js.tpl +++ b/view/theme/frio/templates/events_js.tpl @@ -5,7 +5,7 @@ {{* The link to create a new event *}} {{if $new_event.0}} @@ -40,9 +40,9 @@ {{* The buttons to change the month/weeks/days *}}
      - - - + + +
      {{* The title (e.g. name of the mont/week/day) *}} diff --git a/view/theme/frio/templates/filebrowser.tpl b/view/theme/frio/templates/filebrowser.tpl index d452810c88..ce58ef0b98 100644 --- a/view/theme/frio/templates/filebrowser.tpl +++ b/view/theme/frio/templates/filebrowser.tpl @@ -9,8 +9,8 @@
      - - + + -

      {{$fullname}}

      +

      {{$fullname|escape}}

      {{$str_notifytype}} {{$notify_type}}
      {{* if the contact was suggestested by another contact, the contact who made the suggestion is displayed*}} {{if $madeby}}
      {{$lbl_madeby}} {{$madeby}}
      {{/if}} @@ -51,7 +51,7 @@ a bootstrap modal in the case of approval *}} diff --git a/view/theme/frio/templates/mail_conv.tpl b/view/theme/frio/templates/mail_conv.tpl index 2ad9898495..b5154aa4c0 100644 --- a/view/theme/frio/templates/mail_conv.tpl +++ b/view/theme/frio/templates/mail_conv.tpl @@ -2,13 +2,13 @@
      - {{$mail.from_name}} + {{$mail.from_name|escape}}
      {{$mail.date}}
      -

      {{$mail.from_name}}

      +

      {{$mail.from_name|escape}}

      {{$mail.body}} diff --git a/view/theme/frio/templates/mail_list.tpl b/view/theme/frio/templates/mail_list.tpl index 4a797d47c0..225fd71c18 100644 --- a/view/theme/frio/templates/mail_list.tpl +++ b/view/theme/frio/templates/mail_list.tpl @@ -5,7 +5,7 @@
      - {{$from_name}} + {{$from_name|escape}}
      diff --git a/view/theme/frio/templates/nav.tpl b/view/theme/frio/templates/nav.tpl index d64eae9c49..6f20c247c4 100644 --- a/view/theme/frio/templates/nav.tpl +++ b/view/theme/frio/templates/nav.tpl @@ -40,37 +40,37 @@
    {{$u.created}}{{$u.name}}{{$u.name|escape}} {{$u.email}} - - + +
    {{$u.name}} {{$u.name|escape}} {{$u.email}}{{$u.register_date}}
    {{$u.name}}{{$u.name|escape}} {{$u.email}} {{$u.deleted}}