Peter M. Groen / knowledgetree

Commit 2c87a3b3e60d7eb9cbd2e9cd5eb6df11394b9daa

Authored by nbm
1 parent c32cc5ae

KTS-825: Escape entities in document or folder name in TitleColumn, 

document view, and breadcrumbs.


git-svn-id: https://kt-dms.svn.sourceforge.net/svnroot/kt-dms/trunk@5415 c91229c3-7414-0410-bfa2-8a42b809f60b
Inline Side-by-side
Showing 3 changed files with 5 additions and 5 deletions
lib/browse/BrowseColumns.inc.php
  View file @2c87a3b
@@ -107,14 +107,14 @@ class TitleColumn extends BrowseColumn { @@ -107,14 +107,14 @@ class TitleColumn extends BrowseColumn {
107 107
108 function renderFolderLink($aDataRow) { 108 function renderFolderLink($aDataRow) {
109 $outStr = '<a href="' . $this->buildFolderLink($aDataRow) . '">'; 109 $outStr = '<a href="' . $this->buildFolderLink($aDataRow) . '">';
110 - $outStr .= $aDataRow["folder"]->getName(); 110 + $outStr .= htmlentities($aDataRow["folder"]->getName(), ENT_NOQUOTES, 'UTF-8');
111 $outStr .= '</a> '; 111 $outStr .= '</a> ';
112 return $outStr; 112 return $outStr;
113 } 113 }
114 114
115 function renderDocumentLink($aDataRow) { 115 function renderDocumentLink($aDataRow) {
116 $outStr = '<a href="' . $this->buildDocumentLink($aDataRow) . '" title="' . $aDataRow["document"]->getFilename().'">'; 116 $outStr = '<a href="' . $this->buildDocumentLink($aDataRow) . '" title="' . $aDataRow["document"]->getFilename().'">';
117 - $outStr .= $aDataRow["document"]->getName(); 117 + $outStr .= htmlentities($aDataRow["document"]->getName(), ENT_NOQUOTES, 'UTF-8');
118 $outStr .= '</a>'; 118 $outStr .= '</a>';
119 return $outStr; 119 return $outStr;
120 } 120 }
templates/kt3/standard_page.smarty
  View file @2c87a3b
@@ -104,9 +104,9 @@ @@ -104,9 +104,9 @@
104 {if ($page->breadcrumbs !== false)} 104 {if ($page->breadcrumbs !== false)}
105 {foreach item=aCrumb from=$page->breadcrumbs name=bc} 105 {foreach item=aCrumb from=$page->breadcrumbs name=bc}
106 {if ($aCrumb.url) } 106 {if ($aCrumb.url) }
107 - <a href="{$aCrumb.url}">{$aCrumb.label}</a> 107 + <a href="{$aCrumb.url}">{$aCrumb.label|escape}</a>
108 {else} 108 {else}
109 - <span>{$aCrumb.label}</span> 109 + <span>{$aCrumb.label|escape}</span>
110 {/if} 110 {/if}
111 {if (!$smarty.foreach.bc.last)} 111 {if (!$smarty.foreach.bc.last)}
112 &raquo; 112 &raquo;
templates/kt3/view_document.smarty
  View file @2c87a3b
1 -<h2>{$document->getName()}</h2> 1 +<h2>{$document->getName()|escape}</h2>
2 {capture assign=version} 2 {capture assign=version}
3 {$document->getMajorVersionNumber()}.{$document->getMinorVersionNumber()} 3 {$document->getMajorVersionNumber()}.{$document->getMinorVersionNumber()}
4 {/capture} 4 {/capture}