From d79a6769666164f07832a70f7ff94a4f7c566c32 Mon Sep 17 00:00:00 2001
From: kevin_fourie <kevin_fourie@c91229c3-7414-0410-bfa2-8a42b809f60b>
Date: Thu, 19 Jul 2007 10:57:27 +0000
Subject: [PATCH] Merged in from DEV trunk...

---
 plugins/tagcloud/templates/TagCloud/dashlet.smarty                        | 10 +++++-----
 templates/kt3/fields/base.smarty                                          |  2 +-
 templates/kt3/fields/password.smarty                                      |  2 +-
 templates/kt3/fields/statictext.smarty                                    |  4 ++--
 templates/kt3/fields/text.smarty                                          |  4 ++--
 templates/kt3/notifications/subscriptions.AddDocument.smarty              |  4 ++--
 templates/kt3/notifications/subscriptions.AddFolder.smarty                |  4 ++--
 templates/kt3/notifications/subscriptions.ArchivedDocument.smarty         |  6 +++---
 templates/kt3/notifications/subscriptions.CheckInDocument.smarty          |  6 +++---
 templates/kt3/notifications/subscriptions.CheckOutDocument.smarty         |  6 +++---
 templates/kt3/notifications/subscriptions.DiscussDocument.smarty          | 12 ++++++------
 templates/kt3/notifications/subscriptions.ModifyDocument.smarty           |  6 +++---
 templates/kt3/notifications/subscriptions.MoveDocument.smarty             |  8 ++++----
 templates/kt3/notifications/subscriptions.RemoveChildDocument.smarty      |  6 +++---
 templates/kt3/notifications/subscriptions.RemoveChildFolder.smarty        |  8 ++++----
 templates/kt3/notifications/subscriptions.RemoveSubscribedDocument.smarty |  6 +++---
 templates/kt3/notifications/subscriptions.RemoveSubscribedFolder.smarty   |  6 +++---
 templates/kt3/notifications/subscriptions.RestoreDocument.smarty          |  6 +++---
 templates/kt3/notifications/subscriptions.generic.smarty                  |  2 +-
 templates/kt3/reorderdisplay.smarty                                       |  2 +-
 templates/kt3/standard_page.smarty                                        |  4 ++--
 templates/kt3/view_folder_history.smarty                                  |  2 +-
 templates/ktcore/action/delete.smarty                                     |  2 +-
 templates/ktcore/document/admin/force_checkin_confirm.smarty              |  6 +++---
 templates/ktcore/document/edit.smarty                                     |  2 +-
 templates/ktcore/workflow/editState.smarty                                |  2 +-
 templates/ktcore/workflow/editTransition.smarty                           | 66 +++++++++++++++++++++++++++++++++---------------------------------
 templates/ktcore/workflow/editWorkflow.smarty                             | 10 +++++-----
 templates/ktstandard/PDFPlugin/PDFPlugin.smarty                           |  2 +-
 29 files changed, 103 insertions(+), 103 deletions(-)

diff --git a/plugins/tagcloud/templates/TagCloud/dashlet.smarty b/plugins/tagcloud/templates/TagCloud/dashlet.smarty
index eb06659..1179b4d 100644
--- a/plugins/tagcloud/templates/TagCloud/dashlet.smarty
+++ b/plugins/tagcloud/templates/TagCloud/dashlet.smarty
@@ -2,8 +2,8 @@
 <style type="text/css">
 #tagcloud a, a.link, a.visited, a.hover, a.active {
 
-color: gray; 
-border-bottom: 0px; 
+color: gray;
+border-bottom: 0px;
 text-decoration: none;
 
 }
@@ -17,9 +17,9 @@ There are no tags defined or accessible.
 {else}
 <div id=tagcloud>
 {foreach from=$tags key=tag item=size}
-	
-	<a  href="{$url}&tag={$tag|urlencode}" style="font-size: {$size}px">{$tag}</a>&nbsp;
-	
+
+	<a  href="{$url}&tag={$tag|urlencode}" style="font-size: {$size}px">{$tag|sanitize}</a>&nbsp;
+
 {/foreach}
 </div>
 {/if}
diff --git a/templates/kt3/fields/base.smarty b/templates/kt3/fields/base.smarty
index 0ed3187..ab7b85c 100644
--- a/templates/kt3/fields/base.smarty
+++ b/templates/kt3/fields/base.smarty
@@ -11,5 +11,5 @@
       <p class="errorMessage"></p>
       {/if}
 
-      <input type="text" name="{$name}" {if $has_id}id="{$id}"{/if} {if $has_value}value="{$value}"{/if}{if ($options.autocomplete === false)}autocomplete="off"{/if}  {if $options.width}size="{$options.width}"{/if} /><input type="hidden" name="kt_core_fieldsets_expect[{$name}]" value ="1"  />
+      <input type="text" name="{$name}" {if $has_id}id="{$id}"{/if} {if $has_value}value="{$value|sanitize}"{/if}{if ($options.autocomplete === false)}autocomplete="off"{/if}  {if $options.width}size="{$options.width}"{/if} /><input type="hidden" name="kt_core_fieldsets_expect[{$name}]" value ="1"  />
      </div>
diff --git a/templates/kt3/fields/password.smarty b/templates/kt3/fields/password.smarty
index c212dfb..98acfc2 100644
--- a/templates/kt3/fields/password.smarty
+++ b/templates/kt3/fields/password.smarty
@@ -11,5 +11,5 @@
       <p class="errorMessage"></p>
       {/if}
 
-      <input type="password" name="{$name}" {if $has_id}id="{$id}"{/if} {if $has_value}value="{$value}"{/if}{if ($options.autocomplete === false)}autocomplete="off"{/if}/><input type="hidden" name="kt_core_fieldsets_expect[{$name}]" value ="1"  />
+      <input type="password" name="{$name}" {if $has_id}id="{$id}"{/if} {if $has_value}value="{$value|sanitize}"{/if}{if ($options.autocomplete === false)}autocomplete="off"{/if}/><input type="hidden" name="kt_core_fieldsets_expect[{$name}]" value ="1"  />
      </div>
diff --git a/templates/kt3/fields/statictext.smarty b/templates/kt3/fields/statictext.smarty
index 0cfd427..7780b2f 100644
--- a/templates/kt3/fields/statictext.smarty
+++ b/templates/kt3/fields/statictext.smarty
@@ -10,7 +10,7 @@
       {else}
       <p class="errorMessage"></p>
       {/if}
-      
-      <p {if $has_id}id="{$id}"{/if}>{if $has_value}{$value}{/if}</p>
+
+      <p {if $has_id}id="{$id}"{/if}>{if $has_value}{$value|sanitize}{/if}</p>
       <!-- <input type="hidden" name="kt_core_fieldsets_expect[{$name}]" value ="1"  /> -->
      </div>
diff --git a/templates/kt3/fields/text.smarty b/templates/kt3/fields/text.smarty
index 444e0d1..ea13d4f 100644
--- a/templates/kt3/fields/text.smarty
+++ b/templates/kt3/fields/text.smarty
@@ -10,11 +10,11 @@
       {else}
       <p class="errorMessage"></p>
       {/if}
-      
+
       <textarea name="{$name}"
         {if $has_id} id="{$id}"{/if}
         {if $options.rows} rows="{$options.rows}"{else} rows="7"{/if}
         {if $options.cols} cols="{$options.cols}"{else} cols="45"{/if}
-      >{if $has_value}{$value}{/if}</textarea>
+      >{if $has_value}{$value|sanitize}{/if}</textarea>
       <input type="hidden" name="kt_core_fieldsets_expect[{$name}]" value ="1"  />
      </div>
diff --git a/templates/kt3/notifications/subscriptions.AddDocument.smarty b/templates/kt3/notifications/subscriptions.AddDocument.smarty
index 7046602..0931815 100644
--- a/templates/kt3/notifications/subscriptions.AddDocument.smarty
+++ b/templates/kt3/notifications/subscriptions.AddDocument.smarty
@@ -1,7 +1,7 @@
-<dt class="actionitem subscription">{$info.title}</dt>
+<dt class="actionitem subscription">{$info.title|sanitize}</dt>
 <dd class="actionmessage">
 <!-- could break this up. -->
-    {i18n arg_object_name=$info.object_name}The document "#object_name#" was added{/i18n}{if ($info.location_name !== null)} {i18n arg_location_name=$info.location_name}to "#location_name#"{/i18n}{/if}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}.
+    {i18n arg_object_name=$info.object_name|sanitize}The document "#object_name#" was added{/i18n}{if ($info.location_name !== null)} {i18n arg_location_name=$info.location_name}to "#location_name#"{/i18n}{/if}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}.
     <div class="actionoptions">
         {if !$is_broken}
         <a href="{ktLink base="notify.php" query="id=`$info.notify_id`"}">{i18n}View Document{/i18n}</a>
diff --git a/templates/kt3/notifications/subscriptions.AddFolder.smarty b/templates/kt3/notifications/subscriptions.AddFolder.smarty
index 63dd165..fd23def 100644
--- a/templates/kt3/notifications/subscriptions.AddFolder.smarty
+++ b/templates/kt3/notifications/subscriptions.AddFolder.smarty
@@ -1,7 +1,7 @@
-<dt class="actionitem subscription">{$info.title}</dt>
+<dt class="actionitem subscription">{$info.title|sanitize}</dt>
 <dd class="actionmessage">
 <!-- could break this up. -->
-    {i18n arg_object_name=$info.object_name}The folder "#object_name#" was added{/i18n}{if ($info.location_name !== null)} {i18n arg_location_name=$info.location_name}to "#location_name#"{/i18n}{/if}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}.
+    {i18n arg_object_name=$info.object_name|sanitize}The folder "#object_name#" was added{/i18n}{if ($info.location_name !== null)} {i18n arg_location_name=$info.location_name}to "#location_name#"{/i18n}{/if}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}.
     <div class="actionoptions">
             {if !$is_broken}
         <a href="{ktLink base="notify.php" query="id=`$info.notify_id`"}">{i18n}View New Folder{/i18n}</a>
diff --git a/templates/kt3/notifications/subscriptions.ArchivedDocument.smarty b/templates/kt3/notifications/subscriptions.ArchivedDocument.smarty
index 6a76cd6..32210fa 100644
--- a/templates/kt3/notifications/subscriptions.ArchivedDocument.smarty
+++ b/templates/kt3/notifications/subscriptions.ArchivedDocument.smarty
@@ -1,8 +1,8 @@
-<dt class="actionitem subscription">{$info.title}</dt>
+<dt class="actionitem subscription">{$info.title|sanitize}</dt>
 <dd class="actionmessage">
 <!-- could break this up. -->
-    {i18n arg_object_name=$info.object_name}The document "#object_name#"{/i18n}{if ($info.location_name !== null)} {i18n arg_location_name=$info.location_name}from "#location_name#"{/i18n}{/if} {i18n}was archived{/i18n}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}.
-    <div class="actionoptions">    
+    {i18n arg_object_name=$info.object_name|sanitize}The document "#object_name#"{/i18n}{if ($info.location_name !== null)} {i18n arg_location_name=$info.location_name}from "#location_name#"{/i18n}{/if} {i18n}was archived{/i18n}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}.
+    <div class="actionoptions">
         <a href="{ktLink base="notify.php" query="id=`$info.notify_id`&notify_action=clear"}">{i18n}Clear Alert{/i18n}</a>
     </div>
 </dd>
diff --git a/templates/kt3/notifications/subscriptions.CheckInDocument.smarty b/templates/kt3/notifications/subscriptions.CheckInDocument.smarty
index a5e0a5f..4fe7a1d 100644
--- a/templates/kt3/notifications/subscriptions.CheckInDocument.smarty
+++ b/templates/kt3/notifications/subscriptions.CheckInDocument.smarty
@@ -1,8 +1,8 @@
-<dt class="actionitem subscription">{$info.title}</dt>
+<dt class="actionitem subscription">{$info.title|sanitize}</dt>
 <dd class="actionmessage">
 <!-- could break this up. -->
-    {i18n arg_object_name=$info.object_name}The document "#object_name#" has been checked in{/i18n}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}{if ($info.location_name !== null)}, {i18n arg_location_name=$info.location_name}in the folder "#location_name#"{/i18n}{/if}.
-    <div class="actionoptions">    
+    {i18n arg_object_name=$info.object_name|sanitize}The document "#object_name#" has been checked in{/i18n}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}{if ($info.location_name !== null)}, {i18n arg_location_name=$info.location_name}in the folder "#location_name#"{/i18n}{/if}.
+    <div class="actionoptions">
         {if !$is_broken}
         <a href="{ktLink base="notify.php" query="id=`$info.notify_id`"}">{i18n}View Document{/i18n}</a>
         {else}
diff --git a/templates/kt3/notifications/subscriptions.CheckOutDocument.smarty b/templates/kt3/notifications/subscriptions.CheckOutDocument.smarty
index 7be60f7..4a48000 100644
--- a/templates/kt3/notifications/subscriptions.CheckOutDocument.smarty
+++ b/templates/kt3/notifications/subscriptions.CheckOutDocument.smarty
@@ -1,8 +1,8 @@
-<dt class="actionitem subscription">{$info.title}</dt>
+<dt class="actionitem subscription">{$info.title|sanitize}</dt>
 <dd class="actionmessage">
 <!-- could break this up. -->
-    {i18n arg_object_name=$info.object_name}The document "#object_name#" has been checked out{/i18n}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}{if ($info.location_name !== null)}, {i18n arg_location_name=$info.location_name}from the folder "#location_name#"{/i18n}{/if}.
-    <div class="actionoptions">    
+    {i18n arg_object_name=$info.object_name|sanitize}The document "#object_name#" has been checked out{/i18n}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}{if ($info.location_name !== null)}, {i18n arg_location_name=$info.location_name}from the folder "#location_name#"{/i18n}{/if}.
+    <div class="actionoptions">
         {if !$is_broken}
         <a href="{ktLink base="notify.php" query="id=`$info.notify_id`"}">{i18n}View Document{/i18n}</a>
         {else}
diff --git a/templates/kt3/notifications/subscriptions.DiscussDocument.smarty b/templates/kt3/notifications/subscriptions.DiscussDocument.smarty
index bc2360a..a691323 100644
--- a/templates/kt3/notifications/subscriptions.DiscussDocument.smarty
+++ b/templates/kt3/notifications/subscriptions.DiscussDocument.smarty
@@ -1,12 +1,12 @@
-<dt class="actionitem subscription">{$info.title}</dt>
+<dt class="actionitem subscription">{$info.title|sanitize}</dt>
 <dd class="actionmessage">
 <!-- could break this up. -->
-    {if ($info.has_actor)} 
-    {$info.actor_name} {i18n}has added to the discussion around document{/i18n} "{$info.object_name}".	
-	{else}	
-    The discussion around document "{$info.object_name}" has been updated.	
+    {if ($info.has_actor)}
+    {$info.actor_name} {i18n}has added to the discussion around document{/i18n} "{$info.object_name|sanitize}".
+	{else}
+    The discussion around document "{$info.object_name|sanitize}" has been updated.
 	{/if}
-    <div class="actionoptions">    
+    <div class="actionoptions">
         {if !$is_broken}
         <a href="{ktLink base="notify.php" query="id=`$info.notify_id`"}">{i18n}View Document{/i18n}</a>
         {else}
diff --git a/templates/kt3/notifications/subscriptions.ModifyDocument.smarty b/templates/kt3/notifications/subscriptions.ModifyDocument.smarty
index 1e78df6..c61fb83 100644
--- a/templates/kt3/notifications/subscriptions.ModifyDocument.smarty
+++ b/templates/kt3/notifications/subscriptions.ModifyDocument.smarty
@@ -1,8 +1,8 @@
-<dt class="actionitem subscription">{$info.title}</dt>
+<dt class="actionitem subscription">{$info.title|sanitize}</dt>
 <dd class="actionmessage">
 <!-- could break this up. -->
-    {i18n arg_object_name=$info.object_name}The document "#object_name#" has been changed{/i18n}{if ($info.location_name !== null)} {i18n arg_location_name=$info.location_name}in the folder "#location_name#"{/i18n}{/if}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}.
-    <div class="actionoptions">    
+    {i18n arg_object_name=$info.object_name|sanitize}The document "#object_name#" has been changed{/i18n}{if ($info.location_name !== null)} {i18n arg_location_name=$info.location_name}in the folder "#location_name#"{/i18n}{/if}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}.
+    <div class="actionoptions">
         {if !$is_broken}
         <a href="{ktLink base="notify.php" query="id=`$info.notify_id`"}">{i18n}View Document{/i18n}</a>
         {else}
diff --git a/templates/kt3/notifications/subscriptions.MoveDocument.smarty b/templates/kt3/notifications/subscriptions.MoveDocument.smarty
index 835e559..194c549 100644
--- a/templates/kt3/notifications/subscriptions.MoveDocument.smarty
+++ b/templates/kt3/notifications/subscriptions.MoveDocument.smarty
@@ -1,14 +1,14 @@
-<dt class="actionitem subscription">{$info.title}</dt>
+<dt class="actionitem subscription">{$info.title|sanitize}</dt>
 <dd class="actionmessage">
 <!-- could break this up. -->
-    {i18n arg_object_name=$info.object_name}The document "#object_name#" has been moved{/i18n}{if ($info.location_name !== null)} {i18n arg_location_name=$info.location_name}to the folder "#location_name#"{/i18n}{/if}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}.
-    <div class="actionoptions">    
+    {i18n arg_object_name=$info.object_name|sanitize}The document "#object_name#" has been moved{/i18n}{if ($info.location_name !== null)} {i18n arg_location_name=$info.location_name}to the folder "#location_name#"{/i18n}{/if}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}.
+    <div class="actionoptions">
         {if !$is_broken}
         <a href="{ktLink base="notify.php" query="id=`$info.notify_id`"}">{i18n}View New Location{/i18n}</a>
         {else}
         <span class="descriptiveText">{i18n}Location is no longer available{/i18n}</span>
         {/if}
-        
+
         | <a href="{ktLink base="notify.php" query="id=`$info.notify_id`&notify_action=clear"}">{i18n}Clear Alert{/i18n}</a>
     </div>
 </dd>
diff --git a/templates/kt3/notifications/subscriptions.RemoveChildDocument.smarty b/templates/kt3/notifications/subscriptions.RemoveChildDocument.smarty
index eed935e..e0db4f0 100644
--- a/templates/kt3/notifications/subscriptions.RemoveChildDocument.smarty
+++ b/templates/kt3/notifications/subscriptions.RemoveChildDocument.smarty
@@ -1,8 +1,8 @@
-<dt class="actionitem subscription">{$info.title}</dt>
+<dt class="actionitem subscription">{$info.title|sanitize}</dt>
 <dd class="actionmessage">
 <!-- could break this up. -->
-    {i18n arg_object_name=$info.object_name}The document "#object_name#" has been removed{/i18n}{if ($info.location_name !== null)} {i18n arg_location_name=$info.location_name}from the folder "#location_name#"{/i18n} ({i18n}to which you are subscribed{/i18n}){/if}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}.
-    <div class="actionoptions">    
+    {i18n arg_object_name=$info.object_name|sanitize}The document "#object_name#" has been removed{/i18n}{if ($info.location_name !== null)} {i18n arg_location_name=$info.location_name}from the folder "#location_name#"{/i18n} ({i18n}to which you are subscribed{/i18n}){/if}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}.
+    <div class="actionoptions">
         {if !$is_broken}
         <a href="{ktLink base="notify.php" query="id=`$info.notify_id`"}">{i18n}View Folder{/i18n}</a>
         {else}
diff --git a/templates/kt3/notifications/subscriptions.RemoveChildFolder.smarty b/templates/kt3/notifications/subscriptions.RemoveChildFolder.smarty
index 14598e1..105eaf0 100644
--- a/templates/kt3/notifications/subscriptions.RemoveChildFolder.smarty
+++ b/templates/kt3/notifications/subscriptions.RemoveChildFolder.smarty
@@ -1,14 +1,14 @@
-<dt class="actionitem subscription">{$info.title}</dt>
+<dt class="actionitem subscription">{$info.title|sanitize}</dt>
 <dd class="actionmessage">
 <!-- could break this up. -->
-    {i18n arg_object_name=$info.object_name}The folder "#object_name#" has been removed{/i18n}{if ($info.location_name !== null)} {i18n arg_location_name=$info.location_name}from "#location_name#"{/i18n}{/if}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}.
+    {i18n arg_object_name=$info.object_name|sanitize}The folder "#object_name#" has been removed{/i18n}{if ($info.location_name !== null)} {i18n arg_location_name=$info.location_name}from "#location_name#"{/i18n}{/if}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}.
     <div class="actionoptions">
         {if !$is_broken}
-        <a href="{ktLink base="notify.php" query="id=`$info.notify_id`"}">{i18n}View Folder{/i18n}</a> 
+        <a href="{ktLink base="notify.php" query="id=`$info.notify_id`"}">{i18n}View Folder{/i18n}</a>
         {else}
         <span class="descriptiveText">{i18n}Location is no longer available{/i18n}</span>
         {/if}
-    
+
     | <a href="{ktLink base="notify.php" query="id=`$info.notify_id`&notify_action=clear"}">{i18n}Clear Alert{/i18n}</a>
     </div>
 </dd>
diff --git a/templates/kt3/notifications/subscriptions.RemoveSubscribedDocument.smarty b/templates/kt3/notifications/subscriptions.RemoveSubscribedDocument.smarty
index e2bba38..2ecebd8 100644
--- a/templates/kt3/notifications/subscriptions.RemoveSubscribedDocument.smarty
+++ b/templates/kt3/notifications/subscriptions.RemoveSubscribedDocument.smarty
@@ -1,8 +1,8 @@
-<dt class="actionitem subscription">{$info.title}</dt>
+<dt class="actionitem subscription">{$info.title|sanitize}</dt>
 <dd class="actionmessage">
 <!-- could break this up. -->
-    {i18n arg_object_name=$info.object_name}The document "#object_name#" to which you were subscribed, has been removed{/i18n}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}.
-    <div class="actionoptions">    
+    {i18n arg_object_name=$info.object_name|sanitize}The document "#object_name#" to which you were subscribed, has been removed{/i18n}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}.
+    <div class="actionoptions">
         <a href="{ktLink base="notify.php" query="id=`$info.notify_id`&notify_action=clear"}">{i18n}Clear Alert{/i18n}</a>
     </div>
 </dd>
diff --git a/templates/kt3/notifications/subscriptions.RemoveSubscribedFolder.smarty b/templates/kt3/notifications/subscriptions.RemoveSubscribedFolder.smarty
index 2ec15ad..1a8c49a 100644
--- a/templates/kt3/notifications/subscriptions.RemoveSubscribedFolder.smarty
+++ b/templates/kt3/notifications/subscriptions.RemoveSubscribedFolder.smarty
@@ -1,8 +1,8 @@
-<dt class="actionitem subscription">{$info.title}</dt>
+<dt class="actionitem subscription">{$info.title|sanitize}</dt>
 <dd class="actionmessage">
 <!-- could break this up. -->
-    {i18n arg_object_name=$info.object_name}The folder "#object_name#" to which you were subscribed, has been removed{/i18n}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}.
-    <div class="actionoptions">    
+    {i18n arg_object_name=$info.object_name|sanitize}The folder "#object_name#" to which you were subscribed, has been removed{/i18n}{if ($info.has_actor)} {i18n arg_actor_name=$info.actor_name}by #actor_name#{/i18n}{/if}.
+    <div class="actionoptions">
     <a href="{ktLink base="notify.php" query="id=`$info.notify_id`&notify_action=clear"}">{i18n}Clear Alert{/i18n}</a>
     </div>
 </dd>
diff --git a/templates/kt3/notifications/subscriptions.RestoreDocument.smarty b/templates/kt3/notifications/subscriptions.RestoreDocument.smarty
index 80dc92b..02aa440 100644
--- a/templates/kt3/notifications/subscriptions.RestoreDocument.smarty
+++ b/templates/kt3/notifications/subscriptions.RestoreDocument.smarty
@@ -1,8 +1,8 @@
-<dt class="actionitem subscription">{$info.title}</dt>
+<dt class="actionitem subscription">{$info.title|sanitize}</dt>
 <dd class="actionmessage">
 <!-- could break this up. -->
-    {i18n arg_object_name=$info.object_name}The document "#object_name#" has been restored by an administrator.{/i18n}
-    <div class="actionoptions">    
+    {i18n arg_object_name=$info.object_name|sanitize}The document "#object_name#" has been restored by an administrator.{/i18n}
+    <div class="actionoptions">
         <a href="{ktLink base="notify.php" query="id=`$info.notify_id`&notify_action=clear"}">{i18n}Clear Alert{/i18n}</a>
     </div>
 </dd>
diff --git a/templates/kt3/notifications/subscriptions.generic.smarty b/templates/kt3/notifications/subscriptions.generic.smarty
index 379e3f7..fdc7074 100644
--- a/templates/kt3/notifications/subscriptions.generic.smarty
+++ b/templates/kt3/notifications/subscriptions.generic.smarty
@@ -1,4 +1,4 @@
-<dt class="actionitem subscription">{$info.title}</dt>
+<dt class="actionitem subscription">{$info.title|sanitize}</dt>
 <dd class="actionmessage">
     <div class="actionoptions">
     <a href="{ktLink base="notify.php" query="id=`$info.notify_id`&notify_action=clear"}">{i18n}Clear Alert{/i18n}</a>
diff --git a/templates/kt3/reorderdisplay.smarty b/templates/kt3/reorderdisplay.smarty
index e309802..8da802d 100644
--- a/templates/kt3/reorderdisplay.smarty
+++ b/templates/kt3/reorderdisplay.smarty
@@ -16,7 +16,7 @@
             <td>
                 <input type="hidden" class="reorder-field" name="position[]" value="{$iPosition}" />
                 <input type="hidden" name="id[]" value="{$aItem.id}" />
-                {$aItem.title}
+                {$aItem.title|sanitize}
             </td>
             <td><a href="#" class="reorder-up ktAction ktMoveUp">&nbsp;</a></td>
             <td><a href="#" class="reorder-down ktAction ktMoveDown">&nbsp;</a></td>
diff --git a/templates/kt3/standard_page.smarty b/templates/kt3/standard_page.smarty
index f989abc..34e91de 100644
--- a/templates/kt3/standard_page.smarty
+++ b/templates/kt3/standard_page.smarty
@@ -182,7 +182,7 @@
 				    	<div class="error_dashlet_rightrepeat_bottom"></div>
 				    	<div class="error_dashlet_leftrepeat_bottom"></div>
                         {foreach item=sError from=$page->errStack}
-                            <p>{$sError}</p>
+                            <p>{$sError|sanitize}</p>
                         {/foreach}
                         <div class="error_dashlet_topleft_small"></div>
 			            <div class="error_dashlet_toprepeat_small"></div>
@@ -199,7 +199,7 @@
                     	<div class="info_dashlet_rightrepeat_bottom"></div>
 				    	<div class="info_dashlet_leftrepeat_bottom"></div>
                         {foreach item=sInfo from=$page->infoStack}
-                            <p>{$sInfo}</p>
+                            <p>{$sInfo|sanitize}</p>
                         {/foreach}
                         <div class="info_dashlet_topleft_small"></div>
 			            <div class="info_dashlet_toprepeat_small"></div>
diff --git a/templates/kt3/view_folder_history.smarty b/templates/kt3/view_folder_history.smarty
index 70e214b..669266c 100644
--- a/templates/kt3/view_folder_history.smarty
+++ b/templates/kt3/view_folder_history.smarty
@@ -1,4 +1,4 @@
-<h2><img src="{if $config->get("ui/morphEnabled") == '1'}{$rootUrl}/skins/kts_{$config->get("ui/morphTo")}/title_bullet.png{else}{$rootUrl}/resources/graphics/title_bullet.png{/if}"/>{i18n}Folder Transaction History{/i18n}:<br />{$folder->getName()}</h2>
+<h2><img src="{if $config->get("ui/morphEnabled") == '1'}{$rootUrl}/skins/kts_{$config->get("ui/morphTo")}/title_bullet.png{else}{$rootUrl}/resources/graphics/title_bullet.png{/if}"/>{i18n}Folder Transaction History{/i18n}:<br />{$folder->getName()|sanitize}</h2>
 
 <p class="descriptiveText">{i18n}This page provides details of all activities that have been carried out on the folder.{/i18n}</p>
 
diff --git a/templates/ktcore/action/delete.smarty b/templates/ktcore/action/delete.smarty
index 8cb0577..53e9720 100644
--- a/templates/ktcore/action/delete.smarty
+++ b/templates/ktcore/action/delete.smarty
@@ -1,4 +1,4 @@
-<h2><img src="{if $config->get("ui/morphEnabled") == '1'}{$rootUrl}/skins/kts_{$config->get("ui/morphTo")}/title_bullet.png{else}{$rootUrl}/resources/graphics/title_bullet.png{/if}"/>{i18n}Delete Document{/i18n}:<br />{$context->oDocument->getName()}</h2>
+<h2><img src="{if $config->get("ui/morphEnabled") == '1'}{$rootUrl}/skins/kts_{$config->get("ui/morphTo")}/title_bullet.png{else}{$rootUrl}/resources/graphics/title_bullet.png{/if}"/>{i18n}Delete Document{/i18n}:<br />{$context->oDocument->getName()|sanitize}</h2>
 
 <p class="descriptiveText">{i18n}Deleting a document marks it as no longer
 being displayed.  The document management system does not remove the
diff --git a/templates/ktcore/document/admin/force_checkin_confirm.smarty b/templates/ktcore/document/admin/force_checkin_confirm.smarty
index fdd9553..843e27b 100644
--- a/templates/ktcore/document/admin/force_checkin_confirm.smarty
+++ b/templates/ktcore/document/admin/force_checkin_confirm.smarty
@@ -5,11 +5,11 @@
 <h3>{i18n}Document Details{/i18n}</h3>
 <dl class="metadata">
    <dt>{i18n}Document Name{/i18n}</dt>
-   <dd>{$document->getName()}</dd>
-   
+   <dd>{$document->getName()|sanitize}</dd>
+
    <dt>{i18n}Location{/i18n}</dt>
    <dd>{$document->getDisplayPath()}</dd>
-   
+
    <dt>{i18n}Checked out by{/i18n}</dt>
    {if ($checkout_user !== null)}
    <dd>
diff --git a/templates/ktcore/document/edit.smarty b/templates/ktcore/document/edit.smarty
index 3512dae..ac124e6 100644
--- a/templates/ktcore/document/edit.smarty
+++ b/templates/ktcore/document/edit.smarty
@@ -11,7 +11,7 @@
 
 {$context->oPage->requireCSSResource('resources/css/kt-treewidget.css')}
 
-<h2><img src="{if $config->get("ui/morphEnabled") == '1'}{$rootUrl}/skins/kts_{$config->get("ui/morphTo")}/title_bullet.png{else}{$rootUrl}/resources/graphics/title_bullet.png{/if}"/>{i18n}Edit Metadata{/i18n}:<br />{$context->oDocument->getName()}</h2>
+<h2><img src="{if $config->get("ui/morphEnabled") == '1'}{$rootUrl}/skins/kts_{$config->get("ui/morphTo")}/title_bullet.png{else}{$rootUrl}/resources/graphics/title_bullet.png{/if}"/>{i18n}Edit Metadata{/i18n}:<br />{$context->oDocument->getName()|sanitize}</h2>
 
 {capture assign=link}{addQS}action=selectType&fDocumentId={$document->getId()}{/addQS}{/capture}
 <p class="descriptiveText">{i18n arg_link=$link arg_name=$type_name}Change the <strong><a href="#link#">document type</a></strong>. The current type is "#name#"{/i18n}</p>
diff --git a/templates/ktcore/workflow/editState.smarty b/templates/ktcore/workflow/editState.smarty
index 6863d4d..31a0aab 100644
--- a/templates/ktcore/workflow/editState.smarty
+++ b/templates/ktcore/workflow/editState.smarty
@@ -20,7 +20,7 @@ td.false { background-color: #ffaaaa; text-align: centre }
 {/literal}{/capture}
 {$context->oPage->requireCSSStandalone($sCSS)}
 
-<h2><img src="{if $config->get("ui/morphEnabled") == '1'}{$rootUrl}/skins/kts_{$config->get("ui/morphTo")}/title_bullet.png{else}{$rootUrl}/resources/graphics/title_bullet.png{/if}"/>{i18n}State{/i18n}:<br />{$oState->getName()}</h2>
+<h2><img src="{if $config->get("ui/morphEnabled") == '1'}{$rootUrl}/skins/kts_{$config->get("ui/morphTo")}/title_bullet.png{else}{$rootUrl}/resources/graphics/title_bullet.png{/if}"/>{i18n}State{/i18n}:<br />{$oState->getName()|sanitize}</h2>
 
 <p class="descriptiveText">{i18n}As documents move through their lifecycle, they
 are placed in certain <strong>states</strong>.  For example, an invoice
diff --git a/templates/ktcore/workflow/editTransition.smarty b/templates/ktcore/workflow/editTransition.smarty
index e4f5fae..8b2d07d 100644
--- a/templates/ktcore/workflow/editTransition.smarty
+++ b/templates/ktcore/workflow/editTransition.smarty
@@ -1,4 +1,4 @@
-<h2><img src="{if $config->get("ui/morphEnabled") == '1'}{$rootUrl}/skins/kts_{$config->get("ui/morphTo")}/title_bullet.png{else}{$rootUrl}/resources/graphics/title_bullet.png{/if}"/>{i18n}Transition{/i18n}:<br />{$oTransition->getName()}</h2>
+<h2><img src="{if $config->get("ui/morphEnabled") == '1'}{$rootUrl}/skins/kts_{$config->get("ui/morphTo")}/title_bullet.png{else}{$rootUrl}/resources/graphics/title_bullet.png{/if}"/>{i18n}Transition{/i18n}:<br />{$oTransition->getName()|sanitize}</h2>
 
 <form action="{$smarty.server.PHP_SELF}" method="POST">
 <fieldset>
@@ -32,79 +32,79 @@ requirement.{/i18n}</p>
     occur when a transition is performed, and to control who can perform the transition.  Some triggers
     perform <strong>both</strong> of these functions, especially if performing the action requires that
     certain conditions are in place before the action will occur.{/i18n}</p>
-    
+
     <form method="POST" action="{$smarty.server.PHP_SELF}">
 
     <input type="hidden" name="action" value="addTrigger" />
     <input type="hidden" name="fWorkflowId" value="{$oWorkflow->getId()}" />
     <input type="hidden" name="fTransitionId" value="{$oTransition->getId()}" />
-    
+
     {foreach item=oWidget from=$add_trigger_fields}
       {$oWidget->render()}
-    {/foreach}    
-    
+    {/foreach}
+
     <div class="form_actions">
         <input type="submit" value="Add Trigger" />
     </div>
     </form>
-    
+
     <h3>{i18n}Guards{/i18n}</h3>
-    
+
     <p class="descriptiveText">{i18n}Items which control whether a given user can perform this transition
     on a specific document. <strong>All of these must allow the user to perform the transition.</strong>{/i18n}</p>
     {if empty($aGuardTriggers)}
-    <div class="ktInfoMessage"><span>{i18n}Anybody (with the ability to see the document) can perform this transition.{/i18n}</span></div>    
+    <div class="ktInfoMessage"><span>{i18n}Anybody (with the ability to see the document) can perform this transition.{/i18n}</span></div>
     {else}
-    
+
     <table class="kt_collection narrow" cellspacing="0">
     <thead>
         <tr>
-            <th>{i18n}Trigger{/i18n}</th>        
-            <th>{i18n}Configuration{/i18n}</th>        
-            <th>{i18n}Edit{/i18n}</th>        
-            <th>{i18n}Delete{/i18n}</th>                                          
-        </tr>    
-    </thead>    
+            <th>{i18n}Trigger{/i18n}</th>
+            <th>{i18n}Configuration{/i18n}</th>
+            <th>{i18n}Edit{/i18n}</th>
+            <th>{i18n}Delete{/i18n}</th>
+        </tr>
+    </thead>
     <tbody>
         {foreach from=$aGuardTriggers item=oTrigger}
          <tr>
              <td>{$oTrigger->getName()}</td>
              <td>{$oTrigger->getConfigDescription()}</td>
              <td>{if $oTrigger->bIsConfigurable}<a class="ktAction ktEdit" href="{addQS}action=editTrigger&fWorkflowId={$oWorkflow->getId()}&fTransitionId={$oTransition->getId()}&fTriggerInstanceId={$oTrigger->getConfigId()}{/addQS}">edit</a>{else}&mdash;{/if}</td>
-             <td><a class="ktAction ktDelete" href="{addQS}action=deleteTrigger&fWorkflowId={$oWorkflow->getId()}&fTransitionId={$oTransition->getId()}&fTriggerInstanceId={$oTrigger->getConfigId()}{/addQS}">delete</a></td>                                       
+             <td><a class="ktAction ktDelete" href="{addQS}action=deleteTrigger&fWorkflowId={$oWorkflow->getId()}&fTransitionId={$oTransition->getId()}&fTriggerInstanceId={$oTrigger->getConfigId()}{/addQS}">delete</a></td>
          </tr>
-        {/foreach}    
+        {/foreach}
     </tbody>
-    </table>    
-    
+    </table>
+
     {/if}
     <h3>Actions</h3>
 
-    <p class="descriptiveText">{i18n}Actions which are performed when the document follows the transition.{/i18n}</p>    
+    <p class="descriptiveText">{i18n}Actions which are performed when the document follows the transition.{/i18n}</p>
     {if empty($aActionTriggers)}
-    <div class="ktInfoMessage"><span>{i18n}No actions are performed when this transition occurs.{/i18n}</span></div>    
+    <div class="ktInfoMessage"><span>{i18n}No actions are performed when this transition occurs.{/i18n}</span></div>
     {else}
-    
+
     <table class="kt_collection narrow" cellspacing="0">
     <thead>
         <tr>
-            <th>{i18n}Trigger{/i18n}</th>        
-            <th>{i18n}Configuration{/i18n}</th>        
-            <th>{i18n}Edit{/i18n}</th>        
-            <th>{i18n}Delete{/i18n}</th>                                          
-        </tr>    
-    </thead>    
+            <th>{i18n}Trigger{/i18n}</th>
+            <th>{i18n}Configuration{/i18n}</th>
+            <th>{i18n}Edit{/i18n}</th>
+            <th>{i18n}Delete{/i18n}</th>
+        </tr>
+    </thead>
     <tbody>
         {foreach from=$aActionTriggers item=oTrigger}
          <tr>
              <td>{$oTrigger->getName()}</td>
              <td>{$oTrigger->getConfigDescription()}</td>
              <td>{if $oTrigger->bIsConfigurable}<a class="ktAction ktEdit" href="{addQS}action=editTrigger&fWorkflowId={$oWorkflow->getId()}&fTransitionId={$oTransition->getId()}&fTriggerInstanceId={$oTrigger->getConfigId()}{/addQS}">edit</a>{else}&mdash;{/if}</td>
-             <td><a class="ktAction ktDelete" href="{addQS}action=deleteTrigger&fWorkflowId={$oWorkflow->getId()}&fTransitionId={$oTransition->getId()}&fTriggerInstanceId={$oTrigger->getConfigId()}{/addQS}">delete</a></td>                                       
+             <td><a class="ktAction ktDelete" href="{addQS}action=deleteTrigger&fWorkflowId={$oWorkflow->getId()}&fTransitionId={$oTransition->getId()}&fTriggerInstanceId={$oTrigger->getConfigId()}{/addQS}">delete</a></td>
          </tr>
-        {/foreach}    
+        {/foreach}
     </tbody>
-    </table>    
-        
-    {/if}    
+    </table>
+
+    {/if}
 </fieldset>
diff --git a/templates/ktcore/workflow/editWorkflow.smarty b/templates/ktcore/workflow/editWorkflow.smarty
index 0ddfc8f..f216a2d 100644
--- a/templates/ktcore/workflow/editWorkflow.smarty
+++ b/templates/ktcore/workflow/editWorkflow.smarty
@@ -1,6 +1,6 @@
 {$context->oPage->requireCSSResource('resources/css/workflow-admin.css')}
 
-<h2><img src="{if $config->get("ui/morphEnabled") == '1'}{$rootUrl}/skins/kts_{$config->get("ui/morphTo")}/title_bullet.png{else}{$rootUrl}/resources/graphics/title_bullet.png{/if}"/>{i18n}Workflow Overview{/i18n}:<br />{$oWorkflow->getName()}</h2>
+<h2><img src="{if $config->get("ui/morphEnabled") == '1'}{$rootUrl}/skins/kts_{$config->get("ui/morphTo")}/title_bullet.png{else}{$rootUrl}/resources/graphics/title_bullet.png{/if}"/>{i18n}Workflow Overview{/i18n}:<br />{$oWorkflow->getName()|sanitize}</h2>
 
 
 <form action="{$smarty.server.PHP_SELF}" method="POST">
@@ -34,17 +34,17 @@ or use the "Workflow" menu on the left to create new ones.{/i18n}</p>
         <li>{i18n}Notified groups & roles{/i18n}:
         {$context->getNotificationStringForState($oState)}
         </li>
-        
+
         <li>{i18n}Controlled Actions available{/i18n}:
         {$context->getActionStringForState($oState)}
         </li>
-        
+
         <li>{i18n}Permissions overridden{/i18n}: {$context->getPermissionStringForState($oState)}</li>
-      
+
         <li>{i18n}Transitions available{/i18n}:
         {$context->getTransitionFromStringForState($oState)}
         </li>
-      
+
         <li>{i18n}Transitions to this state{/i18n}:
         {$context->getTransitionToStringForState($oState)}
         </li>
diff --git a/templates/ktstandard/PDFPlugin/PDFPlugin.smarty b/templates/ktstandard/PDFPlugin/PDFPlugin.smarty
index 172fdef..c95a5db 100644
--- a/templates/ktstandard/PDFPlugin/PDFPlugin.smarty
+++ b/templates/ktstandard/PDFPlugin/PDFPlugin.smarty
@@ -1,3 +1,3 @@
-<h2><img src="{if $config->get("ui/morphEnabled") == '1'}{$rootUrl}/skins/kts_{$config->get("ui/morphTo")}/title_bullet.png{else}{$rootUrl}/resources/graphics/title_bullet.png{/if}"/>{i18n}Generate PDF of{/i18n}:<br />{$context->oDocument->getName()}</h2>
+<h2><img src="{if $config->get("ui/morphEnabled") == '1'}{$rootUrl}/skins/kts_{$config->get("ui/morphTo")}/title_bullet.png{else}{$rootUrl}/resources/graphics/title_bullet.png{/if}"/>{i18n}Generate PDF of{/i18n}:<br />{$context->oDocument->getName()|sanitize}</h2>
 
 {$form->render()}
--
libgit2 0.21.4