KTS-2178

"cross site scripting" Updated. Reviewed By: Kevin Fourie git-svn-id: https://kt-dms.svn.sourceforge.net/svnroot/kt-dms/trunk@6950 c91229c3-7414-0410-bfa2-8a42b809f60b

KTS-2178
"cross site scripting" Updated. Reviewed By: Kevin Fourie git-svn-id: https://kt-dms.svn.sourceforge.net/svnroot/kt-dms/trunk@6950 c91229c3-7414-0410-bfa2-8a42b809f60b
conradverm
1 parent 84e027e8
Showing 5 changed files with 16 additions and 16 deletions
templates/ktcore/document/metadata_history.smarty
templates/ktcore/document/ownershipchangeaction.smarty
templates/ktcore/document/resolved_permissions_user.smarty
templates/ktcore/document/transaction_history.smarty
templates/ktcore/document/view.smarty
-<h2><img src="{if $config->get("ui/morphEnabled") == '1'}{$rootUrl}/skins/kts_{$config->get("ui/morphTo")}/title_bullet.png{else}{$rootUrl}/resources/graphics/title_bullet.png{/if}"/>{i18n}Document Version History{/i18n}:<br />{$document->getName()}</h2>
+<h2><img src="{if $config->get("ui/morphEnabled") == '1'}{$rootUrl}/skins/kts_{$config->get("ui/morphTo")}/title_bullet.png{else}{$rootUrl}/resources/graphics/title_bullet.png{/if}"/>{i18n}Document Version History{/i18n}:<br />{$document->getName()|sanitize}</h2>
 <p class="descriptiveText">{i18n}This page lists versions of document metadata and allows you to compare a metadata version with the current metadata content.{/i18n}</p>
@@ -27,9 +27,9 @@
                 {if ($document->getMetadataVersion() == $oVersion->getMetadataVersion())}
                    <strong>{i18n}current version{/i18n}</strong>
                 {else}
-                   <a href="{addQS}action=viewComparison&fDocumentId={$document->getId()}&fBaseVersion={$oVersion->getMetadataVersionId()}&fComparisonVersion={$oVersion->getCurrentMetadataVersionId()}{/addQS}">{i18n}compare with current{/i18n}</a></td>                
+                   <a href="{addQS}action=viewComparison&fDocumentId={$document->getId()}&fBaseVersion={$oVersion->getMetadataVersionId()}&fComparisonVersion={$oVersion->getCurrentMetadataVersionId()}{/addQS}">{i18n}compare with current{/i18n}</a></td>
                 {/if}
-                </td>     
+                </td>
                 <td>
                 {if (count($versions) == 1)}
                 &mdash;
@@ -41,5 +41,5 @@
             </tr>
             {/foreach}
         </tbody>
-        
+
     </table>
-<h2><img src="{if $config->get("ui/morphEnabled") == '1'}{$rootUrl}/skins/kts_{$config->get("ui/morphTo")}/title_bullet.png{else}{$rootUrl}/resources/graphics/title_bullet.png{/if}"/>{i18n}Change Ownership{/i18n}:<br />{$context->oDocument->getName()}</h2>
+<h2><img src="{if $config->get("ui/morphEnabled") == '1'}{$rootUrl}/skins/kts_{$config->get("ui/morphTo")}/title_bullet.png{else}{$rootUrl}/resources/graphics/title_bullet.png{/if}"/>{i18n}Change Ownership{/i18n}:<br />{$context->oDocument->getName()|sanitize}</h2>
 {$form->render()}
-<h2><img src="{if $config->get("ui/morphEnabled") == '1'}{$rootUrl}/skins/kts_{$config->get("ui/morphTo")}/title_bullet.png{else}{$rootUrl}/resources/graphics/title_bullet.png{/if}"/>{i18n}Resolved permissions per user{/i18n}:<br />{$context->oDocument->getName()}</h2>
+<h2><img src="{if $config->get("ui/morphEnabled") == '1'}{$rootUrl}/skins/kts_{$config->get("ui/morphTo")}/title_bullet.png{else}{$rootUrl}/resources/graphics/title_bullet.png{/if}"/>{i18n}Resolved permissions per user{/i18n}:<br />{$context->oDocument->getName()|sanitize}</h2>
 <p class="descriptiveText">{i18n}This page shows the permissions that
 individual users have on this document.  Only the users which have permissions
-assigned are shown.{/i18n}</p> 
+assigned are shown.{/i18n}</p>
 <p class="descriptiveText">{i18n}Users may have permissions on this
 document due to membership of a group, or fulfilling a specific role on
-this document.{/i18n}</p> 
+this document.{/i18n}</p>
 {if (empty($users)) }
 <div class="ktInfoMessage"><span>{i18n}No users have permissions on this item.{/i18n}</span></div>
-<h2><img src="{if $config->get("ui/morphEnabled") == '1'}{$rootUrl}/skins/kts_{$config->get("ui/morphTo")}/title_bullet.png{else}{$rootUrl}/resources/graphics/title_bullet.png{/if}"/>{i18n}Document Transaction History{/i18n}:<br />{$document->getName()}</h2>
+<h2><img src="{if $config->get("ui/morphEnabled") == '1'}{$rootUrl}/skins/kts_{$config->get("ui/morphTo")}/title_bullet.png{else}{$rootUrl}/resources/graphics/title_bullet.png{/if}"/>{i18n}Document Transaction History{/i18n}:<br />{$document->getName()|sanitize}</h2>
 <p class="descriptiveText">{i18n}This page provides details of all activities that have been carried out on the document.{/i18n}</p>
@@ -20,10 +20,10 @@
                 <td class="username">{$aTransactionRow.user_name}</td>
                 <td class="action">{i18n}{$aTransactionRow.transaction_name}{/i18n}</td>
                 <td class="date">{$aTransactionRow.datetime}</td>
-                <td class="contentversion">{$aTransactionRow.version}</td>                
-                <td class="comment">{$aTransactionRow.comment}</td>
+                <td class="contentversion">{$aTransactionRow.version}</td>
+                <td class="comment">{$aTransactionRow.comment|sanitize}</td>
             </tr>
             {/foreach}
         </tbody>
-        
+
     </table>
-<h2><img src="{if $config->get("ui/morphEnabled") == '1'}{$rootUrl}/skins/kts_{$config->get("ui/morphTo")}/title_bullet.png{else}{$rootUrl}/resources/graphics/title_bullet.png{/if}"/>{i18n}Document Details{/i18n}:<br />{$context->oDocument->getName()}</h2>
+<h2><img src="{if $config->get("ui/morphEnabled") == '1'}{$rootUrl}/skins/kts_{$config->get("ui/morphTo")}/title_bullet.png{else}{$rootUrl}/resources/graphics/title_bullet.png{/if}"/>{i18n}Document Details{/i18n}:<br />{$context->oDocument->getName()|sanitize}</h2>
 {if ($document->getIsCheckedOut() == 1)}
 {capture assign=checkout_user}<strong>{$sCheckoutUser}</strong>{/capture}
@@ -9,18 +9,18 @@
 {else}
 {if ($canCheckin)}
 <div class="ktInfoMessage">
-<span>{i18n arg_checkoutuser=$checkout_user}This document is currently checked out by #checkoutuser#, but you 
+<span>{i18n arg_checkoutuser=$checkout_user}This document is currently checked out by #checkoutuser#, but you
 have sufficient priviledges to cancel their checkout.{/i18n}</span>
 </div>
 {else}
 <div class="ktInfoMessage">
-	<span>{i18n arg_checkoutuser=$checkout_user arg_appname="$appname"}This document is currently checked out by #checkoutuser#.  You cannot make 
+	<span>{i18n arg_checkoutuser=$checkout_user arg_appname="$appname"}This document is currently checked out by #checkoutuser#.  You cannot make
 changes until that user checks it in.  If you have urgent modifications to make, please
 contact your #appname# Administrator.{/i18n}</span>
 </div>
 {/if}
 {/if}
-{/if}    
+{/if}
 {if ($document->getImmutable() == true)}
 <div class="ktInfoMessage">