Merged in from DEV trunk...

KTS-2178 "cross site scripting" Implemented. Committed By: Conrad Reviewed By: Kevin git-svn-id: https://kt-dms.svn.sourceforge.net/svnroot/kt-dms/STABLE/trunk@6981 c91229c3-7414-0410-bfa2-8a42b809f60b

Merged in from DEV trunk...
KTS-2178 "cross site scripting" Implemented. Committed By: Conrad Reviewed By: Kevin git-svn-id: https://kt-dms.svn.sourceforge.net/svnroot/kt-dms/STABLE/trunk@6981 c91229c3-7414-0410-bfa2-8a42b809f60b
kevin_fourie
1 parent 03c98e98
Showing 29 changed files with 103 additions and 103 deletions
plugins/tagcloud/templates/TagCloud/dashlet.smarty
templates/kt3/fields/base.smarty
templates/kt3/fields/password.smarty
templates/kt3/fields/statictext.smarty
templates/kt3/fields/text.smarty
templates/kt3/notifications/subscriptions.AddDocument.smarty
templates/kt3/notifications/subscriptions.AddFolder.smarty
templates/kt3/notifications/subscriptions.ArchivedDocument.smarty
templates/kt3/notifications/subscriptions.CheckInDocument.smarty
templates/kt3/notifications/subscriptions.CheckOutDocument.smarty
templates/kt3/notifications/subscriptions.DiscussDocument.smarty
templates/kt3/notifications/subscriptions.ModifyDocument.smarty
templates/kt3/notifications/subscriptions.MoveDocument.smarty
templates/kt3/notifications/subscriptions.RemoveChildDocument.smarty
templates/kt3/notifications/subscriptions.RemoveChildFolder.smarty
templates/kt3/notifications/subscriptions.RemoveSubscribedDocument.smarty
templates/kt3/notifications/subscriptions.RemoveSubscribedFolder.smarty
templates/kt3/notifications/subscriptions.RestoreDocument.smarty
templates/kt3/notifications/subscriptions.generic.smarty
templates/kt3/reorderdisplay.smarty
@@ -2,8 +2,8 @@
 <style type="text/css">
 #tagcloud a, a.link, a.visited, a.hover, a.active {
  
-color: gray; 
-border-bottom: 0px; 
+color: gray;
+border-bottom: 0px;
 text-decoration: none;
  
 }
@@ -17,9 +17,9 @@ There are no tags defined or accessible.
 {else}
 <div id=tagcloud>
 {foreach from=$tags key=tag item=size}
-	
-	<a  href="{$url}&tag={$tag|urlencode}" style="font-size: {$size}px">{$tag}</a>&nbsp;
-	
+
+	<a  href="{$url}&tag={$tag|urlencode}" style="font-size: {$size}px">{$tag|sanitize}</a>&nbsp;
+
 {/foreach}
 </div>
 {/if}
@@ -11,5 +11,5 @@
       <p class="errorMessage"></p>
       {/if}
  
-      <input type="text" name="{$name}" {if $has_id}id="{$id}"{/if} {if $has_value}value="{$value}"{/if}{if ($options.autocomplete === false)}autocomplete="off"{/if}  {if $options.width}size="{$options.width}"{/if} /><input type="hidden" name="kt_core_fieldsets_expect[{$name}]" value ="1"  />
+      <input type="text" name="{$name}" {if $has_id}id="{$id}"{/if} {if $has_value}value="{$value|sanitize}"{/if}{if ($options.autocomplete === false)}autocomplete="off"{/if}  {if $options.width}size="{$options.width}"{/if} /><input type="hidden" name="kt_core_fieldsets_expect[{$name}]" value ="1"  />
      </div>
@@ -11,5 +11,5 @@
       <p class="errorMessage"></p>
       {/if}
  
-      <input type="password" name="{$name}" {if $has_id}id="{$id}"{/if} {if $has_value}value="{$value}"{/if}{if ($options.autocomplete === false)}autocomplete="off"{/if}/><input type="hidden" name="kt_core_fieldsets_expect[{$name}]" value ="1"  />
+      <input type="password" name="{$name}" {if $has_id}id="{$id}"{/if} {if $has_value}value="{$value|sanitize}"{/if}{if ($options.autocomplete === false)}autocomplete="off"{/if}/><input type="hidden" name="kt_core_fieldsets_expect[{$name}]" value ="1"  />
      </div>
@@ -10,7 +10,7 @@
       {else}
       <p class="errorMessage"></p>
       {/if}
-      
-      <p {if $has_id}id="{$id}"{/if}>{if $has_value}{$value}{/if}</p>
+
+      <p {if $has_id}id="{$id}"{/if}>{if $has_value}{$value|sanitize}{/if}</p>
       <!-- <input type="hidden" name="kt_core_fieldsets_expect[{$name}]" value ="1"  /> -->
      </div>
@@ -10,11 +10,11 @@
       {else}
       <p class="errorMessage"></p>
       {/if}
-      
+
       <textarea name="{$name}"
         {if $has_id} id="{$id}"{/if}
         {if $options.rows} rows="{$options.rows}"{else} rows="7"{/if}
         {if $options.cols} cols="{$options.cols}"{else} cols="45"{/if}
-      >{if $has_value}{$value}{/if}</textarea>
+      >{if $has_value}{$value|sanitize}{/if}</textarea>
       <input type="hidden" name="kt_core_fieldsets_expect[{$name}]" value ="1"  />
      </div>
-<dt class="actionitem subscription">{$info.title}</dt>
+<dt class="actionitem subscription">{$info.title|sanitize}</dt>
 <dd class="actionmessage">
 <!-- could break this up. -->
-    {i18n arg_object_name=$info.object_name}The document "#object_name#" was added{/i18n}{if ($info.location_name !== null)} {i18n arg_location_name=$info.location_name}to "#location_name#"{/i18n}{/if}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}.
+    {i18n arg_object_name=$info.object_name|sanitize}The document "#object_name#" was added{/i18n}{if ($info.location_name !== null)} {i18n arg_location_name=$info.location_name}to "#location_name#"{/i18n}{/if}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}.
     <div class="actionoptions">
         {if !$is_broken}
         <a href="{ktLink base="notify.php" query="id=`$info.notify_id`"}">{i18n}View Document{/i18n}</a>
-<dt class="actionitem subscription">{$info.title}</dt>
+<dt class="actionitem subscription">{$info.title|sanitize}</dt>
 <dd class="actionmessage">
 <!-- could break this up. -->
-    {i18n arg_object_name=$info.object_name}The folder "#object_name#" was added{/i18n}{if ($info.location_name !== null)} {i18n arg_location_name=$info.location_name}to "#location_name#"{/i18n}{/if}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}.
+    {i18n arg_object_name=$info.object_name|sanitize}The folder "#object_name#" was added{/i18n}{if ($info.location_name !== null)} {i18n arg_location_name=$info.location_name}to "#location_name#"{/i18n}{/if}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}.
     <div class="actionoptions">
             {if !$is_broken}
         <a href="{ktLink base="notify.php" query="id=`$info.notify_id`"}">{i18n}View New Folder{/i18n}</a>
-<dt class="actionitem subscription">{$info.title}</dt>
+<dt class="actionitem subscription">{$info.title|sanitize}</dt>
 <dd class="actionmessage">
 <!-- could break this up. -->
-    {i18n arg_object_name=$info.object_name}The document "#object_name#"{/i18n}{if ($info.location_name !== null)} {i18n arg_location_name=$info.location_name}from "#location_name#"{/i18n}{/if} {i18n}was archived{/i18n}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}.
-    <div class="actionoptions">    
+    {i18n arg_object_name=$info.object_name|sanitize}The document "#object_name#"{/i18n}{if ($info.location_name !== null)} {i18n arg_location_name=$info.location_name}from "#location_name#"{/i18n}{/if} {i18n}was archived{/i18n}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}.
+    <div class="actionoptions">
         <a href="{ktLink base="notify.php" query="id=`$info.notify_id`&notify_action=clear"}">{i18n}Clear Alert{/i18n}</a>
     </div>
 </dd>
-<dt class="actionitem subscription">{$info.title}</dt>
+<dt class="actionitem subscription">{$info.title|sanitize}</dt>
 <dd class="actionmessage">
 <!-- could break this up. -->
-    {i18n arg_object_name=$info.object_name}The document "#object_name#" has been checked in{/i18n}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}{if ($info.location_name !== null)}, {i18n arg_location_name=$info.location_name}in the folder "#location_name#"{/i18n}{/if}.
-    <div class="actionoptions">    
+    {i18n arg_object_name=$info.object_name|sanitize}The document "#object_name#" has been checked in{/i18n}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}{if ($info.location_name !== null)}, {i18n arg_location_name=$info.location_name}in the folder "#location_name#"{/i18n}{/if}.
+    <div class="actionoptions">
         {if !$is_broken}
         <a href="{ktLink base="notify.php" query="id=`$info.notify_id`"}">{i18n}View Document{/i18n}</a>
         {else}
-<dt class="actionitem subscription">{$info.title}</dt>
+<dt class="actionitem subscription">{$info.title|sanitize}</dt>
 <dd class="actionmessage">
 <!-- could break this up. -->
-    {i18n arg_object_name=$info.object_name}The document "#object_name#" has been checked out{/i18n}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}{if ($info.location_name !== null)}, {i18n arg_location_name=$info.location_name}from the folder "#location_name#"{/i18n}{/if}.
-    <div class="actionoptions">    
+    {i18n arg_object_name=$info.object_name|sanitize}The document "#object_name#" has been checked out{/i18n}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}{if ($info.location_name !== null)}, {i18n arg_location_name=$info.location_name}from the folder "#location_name#"{/i18n}{/if}.
+    <div class="actionoptions">
         {if !$is_broken}
         <a href="{ktLink base="notify.php" query="id=`$info.notify_id`"}">{i18n}View Document{/i18n}</a>
         {else}
-<dt class="actionitem subscription">{$info.title}</dt>
+<dt class="actionitem subscription">{$info.title|sanitize}</dt>
 <dd class="actionmessage">
 <!-- could break this up. -->
-    {if ($info.has_actor)} 
-    {$info.actor_name} {i18n}has added to the discussion around document{/i18n} "{$info.object_name}".	
-	{else}	
-    The discussion around document "{$info.object_name}" has been updated.	
+    {if ($info.has_actor)}
+    {$info.actor_name} {i18n}has added to the discussion around document{/i18n} "{$info.object_name|sanitize}".
+	{else}
+    The discussion around document "{$info.object_name|sanitize}" has been updated.
 	{/if}
-    <div class="actionoptions">    
+    <div class="actionoptions">
         {if !$is_broken}
         <a href="{ktLink base="notify.php" query="id=`$info.notify_id`"}">{i18n}View Document{/i18n}</a>
         {else}
-<dt class="actionitem subscription">{$info.title}</dt>
+<dt class="actionitem subscription">{$info.title|sanitize}</dt>
 <dd class="actionmessage">
 <!-- could break this up. -->
-    {i18n arg_object_name=$info.object_name}The document "#object_name#" has been changed{/i18n}{if ($info.location_name !== null)} {i18n arg_location_name=$info.location_name}in the folder "#location_name#"{/i18n}{/if}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}.
-    <div class="actionoptions">    
+    {i18n arg_object_name=$info.object_name|sanitize}The document "#object_name#" has been changed{/i18n}{if ($info.location_name !== null)} {i18n arg_location_name=$info.location_name}in the folder "#location_name#"{/i18n}{/if}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}.
+    <div class="actionoptions">
         {if !$is_broken}
         <a href="{ktLink base="notify.php" query="id=`$info.notify_id`"}">{i18n}View Document{/i18n}</a>
         {else}
-<dt class="actionitem subscription">{$info.title}</dt>
+<dt class="actionitem subscription">{$info.title|sanitize}</dt>
 <dd class="actionmessage">
 <!-- could break this up. -->
-    {i18n arg_object_name=$info.object_name}The document "#object_name#" has been moved{/i18n}{if ($info.location_name !== null)} {i18n arg_location_name=$info.location_name}to the folder "#location_name#"{/i18n}{/if}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}.
-    <div class="actionoptions">    
+    {i18n arg_object_name=$info.object_name|sanitize}The document "#object_name#" has been moved{/i18n}{if ($info.location_name !== null)} {i18n arg_location_name=$info.location_name}to the folder "#location_name#"{/i18n}{/if}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}.
+    <div class="actionoptions">
         {if !$is_broken}
         <a href="{ktLink base="notify.php" query="id=`$info.notify_id`"}">{i18n}View New Location{/i18n}</a>
         {else}
         <span class="descriptiveText">{i18n}Location is no longer available{/i18n}</span>
         {/if}
-        
+
         | <a href="{ktLink base="notify.php" query="id=`$info.notify_id`&notify_action=clear"}">{i18n}Clear Alert{/i18n}</a>
     </div>
 </dd>
-<dt class="actionitem subscription">{$info.title}</dt>
+<dt class="actionitem subscription">{$info.title|sanitize}</dt>
 <dd class="actionmessage">
 <!-- could break this up. -->
-    {i18n arg_object_name=$info.object_name}The document "#object_name#" has been removed{/i18n}{if ($info.location_name !== null)} {i18n arg_location_name=$info.location_name}from the folder "#location_name#"{/i18n} ({i18n}to which you are subscribed{/i18n}){/if}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}.
-    <div class="actionoptions">    
+    {i18n arg_object_name=$info.object_name|sanitize}The document "#object_name#" has been removed{/i18n}{if ($info.location_name !== null)} {i18n arg_location_name=$info.location_name}from the folder "#location_name#"{/i18n} ({i18n}to which you are subscribed{/i18n}){/if}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}.
+    <div class="actionoptions">
         {if !$is_broken}
         <a href="{ktLink base="notify.php" query="id=`$info.notify_id`"}">{i18n}View Folder{/i18n}</a>
         {else}
-<dt class="actionitem subscription">{$info.title}</dt>
+<dt class="actionitem subscription">{$info.title|sanitize}</dt>
 <dd class="actionmessage">
 <!-- could break this up. -->
-    {i18n arg_object_name=$info.object_name}The folder "#object_name#" has been removed{/i18n}{if ($info.location_name !== null)} {i18n arg_location_name=$info.location_name}from "#location_name#"{/i18n}{/if}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}.
+    {i18n arg_object_name=$info.object_name|sanitize}The folder "#object_name#" has been removed{/i18n}{if ($info.location_name !== null)} {i18n arg_location_name=$info.location_name}from "#location_name#"{/i18n}{/if}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}.
     <div class="actionoptions">
         {if !$is_broken}
-        <a href="{ktLink base="notify.php" query="id=`$info.notify_id`"}">{i18n}View Folder{/i18n}</a> 
+        <a href="{ktLink base="notify.php" query="id=`$info.notify_id`"}">{i18n}View Folder{/i18n}</a>
         {else}
         <span class="descriptiveText">{i18n}Location is no longer available{/i18n}</span>
         {/if}
-    
+
     | <a href="{ktLink base="notify.php" query="id=`$info.notify_id`&notify_action=clear"}">{i18n}Clear Alert{/i18n}</a>
     </div>
 </dd>
-<dt class="actionitem subscription">{$info.title}</dt>
+<dt class="actionitem subscription">{$info.title|sanitize}</dt>
 <dd class="actionmessage">
 <!-- could break this up. -->
-    {i18n arg_object_name=$info.object_name}The document "#object_name#" to which you were subscribed, has been removed{/i18n}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}.
-    <div class="actionoptions">    
+    {i18n arg_object_name=$info.object_name|sanitize}The document "#object_name#" to which you were subscribed, has been removed{/i18n}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}.
+    <div class="actionoptions">
         <a href="{ktLink base="notify.php" query="id=`$info.notify_id`&notify_action=clear"}">{i18n}Clear Alert{/i18n}</a>
     </div>
 </dd>
-<dt class="actionitem subscription">{$info.title}</dt>
+<dt class="actionitem subscription">{$info.title|sanitize}</dt>
 <dd class="actionmessage">
 <!-- could break this up. -->
-    {i18n arg_object_name=$info.object_name}The folder "#object_name#" to which you were subscribed, has been removed{/i18n}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}.
-    <div class="actionoptions">    
+    {i18n arg_object_name=$info.object_name|sanitize}The folder "#object_name#" to which you were subscribed, has been removed{/i18n}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}.
+    <div class="actionoptions">
     <a href="{ktLink base="notify.php" query="id=`$info.notify_id`&notify_action=clear"}">{i18n}Clear Alert{/i18n}</a>
     </div>
 </dd>
-<dt class="actionitem subscription">{$info.title}</dt>
+<dt class="actionitem subscription">{$info.title|sanitize}</dt>
 <dd class="actionmessage">
 <!-- could break this up. -->
-    {i18n arg_object_name=$info.object_name}The document "#object_name#" has been restored by an administrator.{/i18n}
-    <div class="actionoptions">    
+    {i18n arg_object_name=$info.object_name|sanitize}The document "#object_name#" has been restored by an administrator.{/i18n}
+    <div class="actionoptions">
         <a href="{ktLink base="notify.php" query="id=`$info.notify_id`&notify_action=clear"}">{i18n}Clear Alert{/i18n}</a>
     </div>
 </dd>
-<dt class="actionitem subscription">{$info.title}</dt>
+<dt class="actionitem subscription">{$info.title|sanitize}</dt>
 <dd class="actionmessage">
     <div class="actionoptions">
     <a href="{ktLink base="notify.php" query="id=`$info.notify_id`&notify_action=clear"}">{i18n}Clear Alert{/i18n}</a>
@@ -16,7 +16,7 @@
             <td>
                 <input type="hidden" class="reorder-field" name="position[]" value="{$iPosition}" />
                 <input type="hidden" name="id[]" value="{$aItem.id}" />
-                {$aItem.title}
+                {$aItem.title|sanitize}
             </td>
             <td><a href="#" class="reorder-up ktAction ktMoveUp">&nbsp;</a></td>
             <td><a href="#" class="reorder-down ktAction ktMoveDown">&nbsp;</a></td>
@@ -182,7 +182,7 @@
 				    	<div class="error_dashlet_rightrepeat_bottom"></div>
 				    	<div class="error_dashlet_leftrepeat_bottom"></div>
                         {foreach item=sError from=$page->errStack}
-                            <p>{$sError}</p>
+                            <p>{$sError|sanitize}</p>
                         {/foreach}
                         <div class="error_dashlet_topleft_small"></div>
 			            <div class="error_dashlet_toprepeat_small"></div>
@@ -199,7 +199,7 @@
                     	<div class="info_dashlet_rightrepeat_bottom"></div>
 				    	<div class="info_dashlet_leftrepeat_bottom"></div>
                         {foreach item=sInfo from=$page->infoStack}
-                            <p>{$sInfo}</p>
+                            <p>{$sInfo|sanitize}</p>
                         {/foreach}
                         <div class="info_dashlet_topleft_small"></div>
 			            <div class="info_dashlet_toprepeat_small"></div>
-<h2><img src="{if $config->get("ui/morphEnabled") == '1'}{$rootUrl}/skins/kts_{$config->get("ui/morphTo")}/title_bullet.png{else}{$rootUrl}/resources/graphics/title_bullet.png{/if}"/>{i18n}Folder Transaction History{/i18n}:<br />{$folder->getName()}</h2>
+<h2><img src="{if $config->get("ui/morphEnabled") == '1'}{$rootUrl}/skins/kts_{$config->get("ui/morphTo")}/title_bullet.png{else}{$rootUrl}/resources/graphics/title_bullet.png{/if}"/>{i18n}Folder Transaction History{/i18n}:<br />{$folder->getName()|sanitize}</h2>
  
 <p class="descriptiveText">{i18n}This page provides details of all activities that have been carried out on the folder.{/i18n}</p>
  
-<h2><img src="{if $config->get("ui/morphEnabled") == '1'}{$rootUrl}/skins/kts_{$config->get("ui/morphTo")}/title_bullet.png{else}{$rootUrl}/resources/graphics/title_bullet.png{/if}"/>{i18n}Delete Document{/i18n}:<br />{$context->oDocument->getName()}</h2>
+<h2><img src="{if $config->get("ui/morphEnabled") == '1'}{$rootUrl}/skins/kts_{$config->get("ui/morphTo")}/title_bullet.png{else}{$rootUrl}/resources/graphics/title_bullet.png{/if}"/>{i18n}Delete Document{/i18n}:<br />{$context->oDocument->getName()|sanitize}</h2>
  
 <p class="descriptiveText">{i18n}Deleting a document marks it as no longer
 being displayed.  The document management system does not remove the
@@ -5,11 +5,11 @@
 <h3>{i18n}Document Details{/i18n}</h3>
 <dl class="metadata">
    <dt>{i18n}Document Name{/i18n}</dt>
-   <dd>{$document->getName()}</dd>
-   
+   <dd>{$document->getName()|sanitize}</dd>
+
    <dt>{i18n}Location{/i18n}</dt>
    <dd>{$document->getDisplayPath()}</dd>
-   
+
    <dt>{i18n}Checked out by{/i18n}</dt>
    {if ($checkout_user !== null)}
    <dd>
@@ -11,7 +11,7 @@
  
 {$context->oPage->requireCSSResource('resources/css/kt-treewidget.css')}
  
-<h2><img src="{if $config->get("ui/morphEnabled") == '1'}{$rootUrl}/skins/kts_{$config->get("ui/morphTo")}/title_bullet.png{else}{$rootUrl}/resources/graphics/title_bullet.png{/if}"/>{i18n}Edit Metadata{/i18n}:<br />{$context->oDocument->getName()}</h2>
+<h2><img src="{if $config->get("ui/morphEnabled") == '1'}{$rootUrl}/skins/kts_{$config->get("ui/morphTo")}/title_bullet.png{else}{$rootUrl}/resources/graphics/title_bullet.png{/if}"/>{i18n}Edit Metadata{/i18n}:<br />{$context->oDocument->getName()|sanitize}</h2>
  
 {capture assign=link}{addQS}action=selectType&fDocumentId={$document->getId()}{/addQS}{/capture}
 <p class="descriptiveText">{i18n arg_link=$link arg_name=$type_name}Change the <strong><a href="#link#">document type</a></strong>. The current type is "#name#"{/i18n}</p>
@@ -20,7 +20,7 @@ td.false { background-color: #ffaaaa; text-align: centre }
 {/literal}{/capture}
 {$context->oPage->requireCSSStandalone($sCSS)}
  
-<h2><img src="{if $config->get("ui/morphEnabled") == '1'}{$rootUrl}/skins/kts_{$config->get("ui/morphTo")}/title_bullet.png{else}{$rootUrl}/resources/graphics/title_bullet.png{/if}"/>{i18n}State{/i18n}:<br />{$oState->getName()}</h2>
+<h2><img src="{if $config->get("ui/morphEnabled") == '1'}{$rootUrl}/skins/kts_{$config->get("ui/morphTo")}/title_bullet.png{else}{$rootUrl}/resources/graphics/title_bullet.png{/if}"/>{i18n}State{/i18n}:<br />{$oState->getName()|sanitize}</h2>
  
 <p class="descriptiveText">{i18n}As documents move through their lifecycle, they
 are placed in certain <strong>states</strong>.  For example, an invoice
-<h2><img src="{if $config->get("ui/morphEnabled") == '1'}{$rootUrl}/skins/kts_{$config->get("ui/morphTo")}/title_bullet.png{else}{$rootUrl}/resources/graphics/title_bullet.png{/if}"/>{i18n}Transition{/i18n}:<br />{$oTransition->getName()}</h2>
+<h2><img src="{if $config->get("ui/morphEnabled") == '1'}{$rootUrl}/skins/kts_{$config->get("ui/morphTo")}/title_bullet.png{else}{$rootUrl}/resources/graphics/title_bullet.png{/if}"/>{i18n}Transition{/i18n}:<br />{$oTransition->getName()|sanitize}</h2>
  
 <form action="{$smarty.server.PHP_SELF}" method="POST">
 <fieldset>
@@ -32,79 +32,79 @@ requirement.{/i18n}&lt;/p&gt;
     occur when a transition is performed, and to control who can perform the transition.  Some triggers
     perform <strong>both</strong> of these functions, especially if performing the action requires that
     certain conditions are in place before the action will occur.{/i18n}</p>
-    
+
     <form method="POST" action="{$smarty.server.PHP_SELF}">
  
     <input type="hidden" name="action" value="addTrigger" />
     <input type="hidden" name="fWorkflowId" value="{$oWorkflow->getId()}" />
     <input type="hidden" name="fTransitionId" value="{$oTransition->getId()}" />
-    
+
     {foreach item=oWidget from=$add_trigger_fields}
       {$oWidget->render()}
-    {/foreach}    
-    
+    {/foreach}
+
     <div class="form_actions">
         <input type="submit" value="Add Trigger" />
     </div>
     </form>
-    
+
     <h3>{i18n}Guards{/i18n}</h3>
-    
+
     <p class="descriptiveText">{i18n}Items which control whether a given user can perform this transition
     on a specific document. <strong>All of these must allow the user to perform the transition.</strong>{/i18n}</p>
     {if empty($aGuardTriggers)}
-    <div class="ktInfoMessage"><span>{i18n}Anybody (with the ability to see the document) can perform this transition.{/i18n}</span></div>    
+    <div class="ktInfoMessage"><span>{i18n}Anybody (with the ability to see the document) can perform this transition.{/i18n}</span></div>
     {else}
-    
+
     <table class="kt_collection narrow" cellspacing="0">
     <thead>
         <tr>
-            <th>{i18n}Trigger{/i18n}</th>        
-            <th>{i18n}Configuration{/i18n}</th>        
-            <th>{i18n}Edit{/i18n}</th>        
-            <th>{i18n}Delete{/i18n}</th>                                          
-        </tr>    
-    </thead>    
+            <th>{i18n}Trigger{/i18n}</th>
+            <th>{i18n}Configuration{/i18n}</th>
+            <th>{i18n}Edit{/i18n}</th>
+            <th>{i18n}Delete{/i18n}</th>
+        </tr>
+    </thead>
     <tbody>
         {foreach from=$aGuardTriggers item=oTrigger}
          <tr>
              <td>{$oTrigger->getName()}</td>
              <td>{$oTrigger->getConfigDescription()}</td>
              <td>{if $oTrigger->bIsConfigurable}<a class="ktAction ktEdit" href="{addQS}action=editTrigger&fWorkflowId={$oWorkflow->getId()}&fTransitionId={$oTransition->getId()}&fTriggerInstanceId={$oTrigger->getConfigId()}{/addQS}">edit</a>{else}&mdash;{/if}</td>
-             <td><a class="ktAction ktDelete" href="{addQS}action=deleteTrigger&fWorkflowId={$oWorkflow->getId()}&fTransitionId={$oTransition->getId()}&fTriggerInstanceId={$oTrigger->getConfigId()}{/addQS}">delete</a></td>                                       
+             <td><a class="ktAction ktDelete" href="{addQS}action=deleteTrigger&fWorkflowId={$oWorkflow->getId()}&fTransitionId={$oTransition->getId()}&fTriggerInstanceId={$oTrigger->getConfigId()}{/addQS}">delete</a></td>
          </tr>
-        {/foreach}    
+        {/foreach}
     </tbody>
-    </table>    
-    
+    </table>
+
     {/if}
     <h3>Actions</h3>
  
-    <p class="descriptiveText">{i18n}Actions which are performed when the document follows the transition.{/i18n}</p>    
+    <p class="descriptiveText">{i18n}Actions which are performed when the document follows the transition.{/i18n}</p>
     {if empty($aActionTriggers)}
-    <div class="ktInfoMessage"><span>{i18n}No actions are performed when this transition occurs.{/i18n}</span></div>    
+    <div class="ktInfoMessage"><span>{i18n}No actions are performed when this transition occurs.{/i18n}</span></div>
     {else}
-    
+
     <table class="kt_collection narrow" cellspacing="0">
     <thead>
         <tr>
-            <th>{i18n}Trigger{/i18n}</th>        
-            <th>{i18n}Configuration{/i18n}</th>        
-            <th>{i18n}Edit{/i18n}</th>        
-            <th>{i18n}Delete{/i18n}</th>                                          
-        </tr>    
-    </thead>    
+            <th>{i18n}Trigger{/i18n}</th>
+            <th>{i18n}Configuration{/i18n}</th>
+            <th>{i18n}Edit{/i18n}</th>
+            <th>{i18n}Delete{/i18n}</th>
+        </tr>
+    </thead>
     <tbody>
         {foreach from=$aActionTriggers item=oTrigger}
          <tr>
              <td>{$oTrigger->getName()}</td>
              <td>{$oTrigger->getConfigDescription()}</td>
              <td>{if $oTrigger->bIsConfigurable}<a class="ktAction ktEdit" href="{addQS}action=editTrigger&fWorkflowId={$oWorkflow->getId()}&fTransitionId={$oTransition->getId()}&fTriggerInstanceId={$oTrigger->getConfigId()}{/addQS}">edit</a>{else}&mdash;{/if}</td>
-             <td><a class="ktAction ktDelete" href="{addQS}action=deleteTrigger&fWorkflowId={$oWorkflow->getId()}&fTransitionId={$oTransition->getId()}&fTriggerInstanceId={$oTrigger->getConfigId()}{/addQS}">delete</a></td>                                       
+             <td><a class="ktAction ktDelete" href="{addQS}action=deleteTrigger&fWorkflowId={$oWorkflow->getId()}&fTransitionId={$oTransition->getId()}&fTriggerInstanceId={$oTrigger->getConfigId()}{/addQS}">delete</a></td>
          </tr>
-        {/foreach}    
+        {/foreach}
     </tbody>
-    </table>    
-        
-    {/if}    
+    </table>
+
+    {/if}
 </fieldset>
 {$context->oPage->requireCSSResource('resources/css/workflow-admin.css')}
  
-<h2><img src="{if $config->get("ui/morphEnabled") == '1'}{$rootUrl}/skins/kts_{$config->get("ui/morphTo")}/title_bullet.png{else}{$rootUrl}/resources/graphics/title_bullet.png{/if}"/>{i18n}Workflow Overview{/i18n}:<br />{$oWorkflow->getName()}</h2>
+<h2><img src="{if $config->get("ui/morphEnabled") == '1'}{$rootUrl}/skins/kts_{$config->get("ui/morphTo")}/title_bullet.png{else}{$rootUrl}/resources/graphics/title_bullet.png{/if}"/>{i18n}Workflow Overview{/i18n}:<br />{$oWorkflow->getName()|sanitize}</h2>
  
  
 <form action="{$smarty.server.PHP_SELF}" method="POST">
@@ -34,17 +34,17 @@ or use the &quot;Workflow&quot; menu on the left to create new ones.{/i18n}&lt;/p&gt;
         <li>{i18n}Notified groups & roles{/i18n}:
         {$context->getNotificationStringForState($oState)}
         </li>
-        
+
         <li>{i18n}Controlled Actions available{/i18n}:
         {$context->getActionStringForState($oState)}
         </li>
-        
+
         <li>{i18n}Permissions overridden{/i18n}: {$context->getPermissionStringForState($oState)}</li>
-      
+
         <li>{i18n}Transitions available{/i18n}:
         {$context->getTransitionFromStringForState($oState)}
         </li>
-      
+
         <li>{i18n}Transitions to this state{/i18n}:
         {$context->getTransitionToStringForState($oState)}
         </li>
-<h2><img src="{if $config->get("ui/morphEnabled") == '1'}{$rootUrl}/skins/kts_{$config->get("ui/morphTo")}/title_bullet.png{else}{$rootUrl}/resources/graphics/title_bullet.png{/if}"/>{i18n}Generate PDF of{/i18n}:<br />{$context->oDocument->getName()}</h2>
+<h2><img src="{if $config->get("ui/morphEnabled") == '1'}{$rootUrl}/skins/kts_{$config->get("ui/morphTo")}/title_bullet.png{else}{$rootUrl}/resources/graphics/title_bullet.png{/if}"/>{i18n}Generate PDF of{/i18n}:<br />{$context->oDocument->getName()|sanitize}</h2>
  
 {$form->render()}