Merged in from DEV trunk...

KTS-2178 "cross site scripting" Implemented. Committed By: Conrad Vermeulen Reviewed By: Kevin Fourie git-svn-id: https://kt-dms.svn.sourceforge.net/svnroot/kt-dms/STABLE/trunk@7001 c91229c3-7414-0410-bfa2-8a42b809f60b

Merged in from DEV trunk...
KTS-2178 "cross site scripting" Implemented. Committed By: Conrad Vermeulen Reviewed By: Kevin Fourie git-svn-id: https://kt-dms.svn.sourceforge.net/svnroot/kt-dms/STABLE/trunk@7001 c91229c3-7414-0410-bfa2-8a42b809f60b
kevin_fourie
1 parent 91f271fb
Showing 7 changed files with 8 additions and 8 deletions
templates/kt3/browse.smarty
templates/kt3/fields/lookup.smarty
templates/kt3/minimal_page.smarty
templates/kt3/portlets/search_portlet.smarty
templates/kt3/standard_page.smarty
templates/ktcore/action/checkout_final.smarty
templates/ktcore/search/administration/savedsearches.smarty
@@ -73,7 +73,7 @@
 <legend>{i18n}Save this search{/i18n}</legend>
 <p class="descriptiveText">{i18n}To save this search permanently, so that you can run it again at any time, fill in a name below and click 'Save'.{/i18n}</p>
 <input type="hidden" name="action" value="saveSearch" />
-<input type="hidden" name="boolean_search" value="{$boolean_search}" />
+<input type="hidden" name="boolean_search" value="{$boolean_search|sanitize}" />
 {foreach item=oWidget from=$save_fields}
     {$oWidget->render()}
 {/foreach}
@@ -10,10 +10,10 @@
       {else}
       <p class="errorMessage"></p>
       {/if}
-      
+
       <select name="{$name}" {if $has_id}id="{$id}"{/if} {if $options.multi}multiple="true"{/if} {if $options.size}size="{$options.size}"{/if}>
       {foreach item=lookup key=lookup_key from=$options.vocab}
-           <option value="{$lookup_key}" {if ($value == $lookup_key)}selected="selected"{/if}>{$lookup}</option>
+           <option value="{$lookup_key}" {if ($value == $lookup_key)}selected="selected"{/if}>{$lookup|sanitize}</option>
       {/foreach}
       </select>
       <input type="hidden" name="kt_core_fieldsets_expect[{$name}]" value ="1" />
@@ -2,7 +2,7 @@
 "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
 <html>
 <head>
-    <title>{$page->title} | {$page->systemName}</title>
+    <title>{$page->title|sanitize} | {$page->systemName}</title>
     <!-- CSS Files. -->
     {foreach item=sResourceURL from=$page->getCSSResources()}
@@ -9,7 +9,7 @@
 <ul class="actionlist">
 {foreach item=oSearch from=$saved_searches}
 <li>
-{if ($oSearch->getUserId())}<a class="ktInline ktAction ktDelete" href="{"booleanSearch"|generateControllerUrl}&qs[action]=deleteSearch&qs[fSavedSearchId]={$oSearch->getId()}&qs[fFolderId]={$folder_id}&qs[fDocumentId]={$document_id}">{i18n}Delete{/i18n}</a>{/if}<a href="{"booleanSearch"|generateControllerUrl}&qs[action]=performSearch&qs[fSavedSearchId]={$oSearch->getId()}">{$oSearch->getName()}</a>
+{if ($oSearch->getUserId())}<a class="ktInline ktAction ktDelete" href="{"booleanSearch"|generateControllerUrl}&qs[action]=deleteSearch&qs[fSavedSearchId]={$oSearch->getId()}&qs[fFolderId]={$folder_id}&qs[fDocumentId]={$document_id}">{i18n}Delete{/i18n}</a>{/if}<a href="{"booleanSearch"|generateControllerUrl}&qs[action]=performSearch&qs[fSavedSearchId]={$oSearch->getId()}">{$oSearch->getName()|sanitize}</a>
 </li>
 {/foreach}
 </ul>
@@ -2,7 +2,7 @@
 "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
 <html>
 <head>
-    <title>{$page->title}{if ($page->secondary_title != null)} &mdash; {$page->secondary_title}{/if} | {$page->systemName}</title>
+    <title>{$page->title|sanitize}{if ($page->secondary_title != null)} &mdash; {$page->secondary_title|sanitize}{/if} | {$page->systemName}</title>
     <!-- CSS Files. -->
@@ -3,7 +3,7 @@
 {$context->oPage->requireJSResource("thirdpartyjs/MochiKit/Iter.js")}
 {$context->oPage->requireJSResource("thirdpartyjs/MochiKit/DOM.js")}
-{capture assign=sLocation}action=checkout_final&fDocumentId={$context->oDocument->getId()}&reason={$reason}{/capture}
+{capture assign=sLocation}action=checkout_final&fDocumentId={$context->oDocument->getId()}&reason={$reason|escape:'url'}{/capture}
 {capture assign=sJavascript}
 function doCheckout () {ldelim}
@@ -31,7 +31,7 @@ newsletters, etc.) based on a category or fieldset value.{/i18n}&lt;/p&gt;
 <tbody>
 {foreach item=oSearch from=$saved_searches}
     <tr>
-        <td>{$oSearch->getName()}</td>
+        <td>{$oSearch->getName()|sanitize}</td>
 	{capture assign=iUserId}{$oSearch->getUserId()}{/capture}
 	<td>{if ($iUserId === '')}Global{else}{$context->_getUserName($iUserId)}{/if}</td>
         <td><a href="{addQS}action=edit&fSavedSearchId={$oSearch->getId()}{/addQS}" class="ktAction ktEdit">{i18n}Edit{/i18n}</a></td>