Commit ad9a6092f6ccee77d9b4f249296aaab6a3b46f09
1 parent
d79a6769
Merged in from DEV trunk...
KTS-2178 "cross site scripting" Implemented. Committed By: Conrad Reviewed By: Kevin git-svn-id: https://kt-dms.svn.sourceforge.net/svnroot/kt-dms/STABLE/trunk@6985 c91229c3-7414-0410-bfa2-8a42b809f60b
Showing
3 changed files
with
4 additions
and
4 deletions
templates/kt3/browse.smarty
| @@ -44,7 +44,7 @@ | @@ -44,7 +44,7 @@ | ||
| 44 | <input type="hidden" name="sListCode" value="{$code}" /> | 44 | <input type="hidden" name="sListCode" value="{$code}" /> |
| 45 | <input type="hidden" name="action" value="bulkaction" /> | 45 | <input type="hidden" name="action" value="bulkaction" /> |
| 46 | <input type="hidden" name="fReturnAction" value="{$returnaction}" /> | 46 | <input type="hidden" name="fReturnAction" value="{$returnaction}" /> |
| 47 | - <input type="hidden" name="fReturnData" value="{$returndata}" /> | 47 | + <input type="hidden" name="fReturnData" value="{$returndata|sanitize}" /> |
| 48 | 48 | ||
| 49 | {foreach from=$bulkactions item=bulkaction} | 49 | {foreach from=$bulkactions item=bulkaction} |
| 50 | <input type="submit" name="submit[{$bulkaction->getName()}]" value="{$bulkaction->getDisplayName()}" /> | 50 | <input type="submit" name="submit[{$bulkaction->getName()}]" value="{$bulkaction->getDisplayName()}" /> |
templates/ktcore/assist/assist_notification.smarty
| 1 | -<dt class="actionitem">{$subject}</dt> | 1 | +<dt class="actionitem">{$subject|sanitize}</dt> |
| 2 | <dd class="actionmessage"> | 2 | <dd class="actionmessage"> |
| 3 | - {i18n arg_name=$document_name arg_state=$state_name arg_user=$actor->getName()}A | 3 | + {i18n arg_name=$document_name|sanitize arg_state=$state_name arg_user=$actor->getName()}A |
| 4 | user, <b>#user#</b>, has requested help on the document <b>#name#</b>, and you are | 4 | user, <b>#user#</b>, has requested help on the document <b>#name#</b>, and you are |
| 5 | the owner or an admin of this document.{/i18n} | 5 | the owner or an admin of this document.{/i18n} |
| 6 | <div class="actionoptions"> | 6 | <div class="actionoptions"> |
templates/ktcore/assist/assist_notification_details.smarty
| 1 | <p class="descriptiveText"> | 1 | <p class="descriptiveText"> |
| 2 | - {i18n arg_name=$document_name arg_state=$state_name arg_user=$actor->getName()}A | 2 | + {i18n arg_name=$document_name|sanitize arg_state=$state_name arg_user=$actor->getName()}A |
| 3 | user, <b>#user#</b>, has requested help on the document <b>#name#</b>, and you are | 3 | user, <b>#user#</b>, has requested help on the document <b>#name#</b>, and you are |
| 4 | the owner or an admin of this document.{/i18n} | 4 | the owner or an admin of this document.{/i18n} |
| 5 | </p> | 5 | </p> |