From 3b5c62f697d26d194bc869cebc6e451edfec0278 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rub=C3=A9n=20D?= Date: Tue, 24 May 2022 06:56:44 +0200 Subject: [PATCH] fix: Prevent XSS on all output variables. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Rubén D --- .../views/account/account-editpass.inc | 6 +- .../views/account/account-history.inc | 29 ++++-- .../views/account/account-link.inc | 12 +-- .../views/account/account-permissions.inc | 20 ++-- .../views/account/account-request.inc | 4 +- .../material-blue/views/account/account.inc | 16 ++-- .../material-blue/views/account/details.inc | 8 +- .../views/account/files-list.inc | 4 +- .../views/account/linkedAccounts.inc | 2 +- .../views/account/search-rows.inc | 92 ++++++++++++++----- .../views/account/search-searchbox.inc | 6 +- .../views/common/aux-customfields.inc | 8 +- .../material-blue/views/config/encryption.inc | 2 +- .../views/config/general-auth.inc | 4 +- .../material-blue/views/config/import.inc | 4 +- .../material-blue/views/config/ldap.inc | 12 +-- .../views/config/wiki-dokuwiki.inc | 2 +- .../views/itemshow/account_bulkedit.inc | 18 ++-- .../views/itemshow/auth_token.inc | 4 +- .../material-blue/views/itemshow/category.inc | 4 +- .../material-blue/views/itemshow/client.inc | 4 +- .../views/itemshow/custom_field.inc | 2 +- .../material-blue/views/itemshow/file.inc | 2 +- .../views/itemshow/item_preset-password.inc | 2 +- .../views/itemshow/item_preset-permission.inc | 8 +- .../views/itemshow/item_preset.inc | 6 +- .../views/itemshow/public_link.inc | 9 +- .../material-blue/views/itemshow/tag.inc | 2 +- .../material-blue/views/itemshow/user.inc | 22 +++-- .../views/itemshow/user_group.inc | 25 +++-- .../views/itemshow/user_pass.inc | 4 +- .../views/itemshow/user_profile.inc | 2 +- .../views/notification/notification.inc | 37 +++++--- 33 files changed, 239 insertions(+), 143 deletions(-) diff --git a/app/modules/web/themes/material-blue/views/account/account-editpass.inc b/app/modules/web/themes/material-blue/views/account/account-editpass.inc index 31e45cd8..498fad52 100644 --- a/app/modules/web/themes/material-blue/views/account/account-editpass.inc +++ b/app/modules/web/themes/material-blue/views/account/account-editpass.inc @@ -36,7 +36,7 @@ $accountAcl = $_getvar('accountAcl');
@@ -49,7 +49,7 @@ $accountAcl = $_getvar('accountAcl');
@@ -75,7 +75,7 @@ $accountAcl = $_getvar('accountAcl');
diff --git a/app/modules/web/themes/material-blue/views/account/account-history.inc b/app/modules/web/themes/material-blue/views/account/account-history.inc index bcb26c4c..662c7dfa 100644 --- a/app/modules/web/themes/material-blue/views/account/account-history.inc +++ b/app/modules/web/themes/material-blue/views/account/account-history.inc @@ -55,7 +55,7 @@ $accountAcl = $_getvar('accountAcl'); required class="mdl-textfield__input mdl-color-text--indigo-400" maxlength="50" - value="getName()); ?>" + value="getName(), ENT_QUOTES); ?>" tabindex="1" readonly> @@ -73,7 +73,10 @@ $accountAcl = $_getvar('accountAcl'); + value="getId(); ?>" + isSelected() ? 'selected' : ''; ?>> + getName(), ENT_QUOTES); ?> + @@ -90,7 +93,10 @@ $accountAcl = $_getvar('accountAcl'); + value="getId(); ?>" + isSelected() ? 'selected' : ''; ?>> + getName(), ENT_QUOTES); ?> + @@ -116,7 +122,7 @@ $accountAcl = $_getvar('accountAcl'); @@ -147,7 +153,8 @@ $accountAcl = $_getvar('accountAcl'); rows="3" id="notes" name="notes" tabindex="9" maxlength="5000" - readonly>getNotes()); ?> + readonly>getNotes(), ENT_QUOTES); ?> +
@@ -168,7 +175,9 @@ $accountAcl = $_getvar('accountAcl'); foreach ($_getvar('historyData') as $history): ?> + isSelected() ? 'selected' : ''; ?>> + getName(), ENT_QUOTES); ?> + @@ -177,7 +186,13 @@ $accountAcl = $_getvar('accountAcl'); - getDateEdit(), htmlentities($accountData->getUserEditName()) ?: htmlentities($accountData->getUserEditLogin())); ?> + + getDateEdit(), + htmlspecialchars($accountData->getUserEditName(), ENT_QUOTES) + ?: htmlspecialchars($accountData->getUserEditLogin(), ENT_QUOTES)); ?> + diff --git a/app/modules/web/themes/material-blue/views/account/account-link.inc b/app/modules/web/themes/material-blue/views/account/account-link.inc index b3339d00..97f1a25c 100644 --- a/app/modules/web/themes/material-blue/views/account/account-link.inc +++ b/app/modules/web/themes/material-blue/views/account/account-link.inc @@ -29,7 +29,7 @@ $accountData = $_getvar('accountData'); @@ -42,7 +42,7 @@ $accountData = $_getvar('accountData');
@@ -55,7 +55,7 @@ $accountData = $_getvar('accountData');
@@ -68,7 +68,7 @@ $accountData = $_getvar('accountData');
@@ -81,7 +81,7 @@ $accountData = $_getvar('accountData');
@@ -97,7 +97,7 @@ $accountData = $_getvar('accountData'); rows="3" id="notes" name="notes" maxlength="1000" - readonly>getNotes()); ?> + readonly>getNotes(), ENT_QUOTES); ?>
diff --git a/app/modules/web/themes/material-blue/views/account/account-permissions.inc b/app/modules/web/themes/material-blue/views/account/account-permissions.inc index b19205aa..2926c007 100644 --- a/app/modules/web/themes/material-blue/views/account/account-permissions.inc +++ b/app/modules/web/themes/material-blue/views/account/account-permissions.inc @@ -35,7 +35,7 @@ use SP\Services\Account\AccountAcl; isSkip()): continue; endif; ?> + isSelected() ? 'selected' : '' ?>>getName(), ENT_QUOTES); ?> isSelected()): ?> - getName()); ?> + getName(), ENT_QUOTES); ?>
@@ -68,7 +68,7 @@ use SP\Services\Account\AccountAcl; isSkip()): continue; endif; ?> + isSelected() ? 'selected' : '' ?>>getName(), ENT_QUOTES); ?> isSelected()): ?> - getName()); ?> + getName(), ENT_QUOTES); ?>
@@ -107,7 +107,7 @@ use SP\Services\Account\AccountAcl; isSkip()): continue; endif; ?> + isSelected() ? 'selected' : '' ?>>getName(), ENT_QUOTES); ?> isSelected()): ?> - getName()); ?> + getName(), ENT_QUOTES); ?>
@@ -140,7 +140,7 @@ use SP\Services\Account\AccountAcl; isSkip()): continue; endif; ?> + isSelected() ? 'selected' : '' ?>>getName(), ENT_QUOTES); ?> isSelected()): ?> - getName()); ?> + getName(), ENT_QUOTES); ?>
@@ -189,7 +189,7 @@ use SP\Services\Account\AccountAcl; foreach ($_getvar('users') as $user): ?> + isSelected() ? 'selected' : ''; ?>>getName(), ENT_QUOTES); ?> @@ -213,7 +213,7 @@ use SP\Services\Account\AccountAcl; foreach ($_getvar('userGroups') as $userGroup): ?> + isSelected() ? 'selected' : ''; ?>>getName(), ENT_QUOTES); ?> diff --git a/app/modules/web/themes/material-blue/views/account/account-request.inc b/app/modules/web/themes/material-blue/views/account/account-request.inc index 40918324..01d2e018 100644 --- a/app/modules/web/themes/material-blue/views/account/account-request.inc +++ b/app/modules/web/themes/material-blue/views/account/account-request.inc @@ -32,7 +32,7 @@ $accountData = $_getvar('accountData');
@@ -45,7 +45,7 @@ $accountData = $_getvar('accountData');
diff --git a/app/modules/web/themes/material-blue/views/account/account.inc b/app/modules/web/themes/material-blue/views/account/account.inc index 3fbeca71..1038ae6f 100644 --- a/app/modules/web/themes/material-blue/views/account/account.inc +++ b/app/modules/web/themes/material-blue/views/account/account.inc @@ -81,7 +81,7 @@ $showCustomFields = count($_getvar('customFields', 0)) > 0; class="mdl-textfield__input mdl-color-text--indigo-400" maxlength="100" value="getName()) + ? htmlspecialchars($accountData->getName(), ENT_QUOTES) : ''; ?>" > @@ -108,7 +108,7 @@ $showCustomFields = count($_getvar('customFields', 0)) > 0; ? 'selected' : ''; ?> > - getName(); ?> + getName(), ENT_QUOTES); ?> @@ -140,7 +140,7 @@ $showCustomFields = count($_getvar('customFields', 0)) > 0; ? 'selected' : ''; ?> > - getName()); ?> + getName(), ENT_QUOTES); ?> @@ -180,7 +180,7 @@ $showCustomFields = count($_getvar('customFields', 0)) > 0; class="mdl-textfield__input mdl-color-text--indigo-400" maxlength="50" value="getLogin()) + ? htmlspecialchars($accountData->getLogin(), ENT_QUOTES) : ''; ?>" > @@ -275,7 +275,7 @@ $showCustomFields = count($_getvar('customFields', 0)) > 0; foreach ($_getvar('tags') as $tag): ?> @@ -301,7 +301,7 @@ $showCustomFields = count($_getvar('customFields', 0)) > 0; isSelected()): ?> - getName()); ?> + getName(), ENT_QUOTES); ?>
@@ -345,7 +345,7 @@ $showCustomFields = count($_getvar('customFields', 0)) > 0; foreach ($_getvar('historyData') as $history): ?> @@ -360,7 +360,7 @@ $showCustomFields = count($_getvar('customFields', 0)) > 0; getDateEdit(), - $accountData->getUserEditName()); ?> + htmlspecialchars($accountData->getUserEditName(), ENT_QUOTES)); ?> diff --git a/app/modules/web/themes/material-blue/views/account/details.inc b/app/modules/web/themes/material-blue/views/account/details.inc index 2b180eb6..df7a5833 100644 --- a/app/modules/web/themes/material-blue/views/account/details.inc +++ b/app/modules/web/themes/material-blue/views/account/details.inc @@ -38,7 +38,7 @@ use SP\Services\Account\AccountAcl;
- getDateEdit(), htmlentities($accountData->getUserEditName())); ?> + getDateEdit(), htmlspecialchars($accountData->getUserEditName(), ENT_QUOTES)); ?> @@ -48,7 +48,7 @@ use SP\Services\Account\AccountAcl;
- getUserName()) ?: htmlentities($accountData->getUserLogin()); ?> + getUserName(), ENT_QUOTES) ?: htmlspecialchars($accountData->getUserLogin(), ENT_QUOTES); ?> @@ -56,7 +56,7 @@ use SP\Services\Account\AccountAcl;
- getUserGroupName()); ?> + getUserGroupName(), ENT_QUOTES); ?> @@ -74,7 +74,7 @@ use SP\Services\Account\AccountAcl;
- getUserEditName()) ?: htmlentities($accountData->getUserEditLogin()); ?> + getUserEditName(), ENT_QUOTES) ?: htmlspecialchars($accountData->getUserEditLogin(), ENT_QUOTES); ?> diff --git a/app/modules/web/themes/material-blue/views/account/files-list.inc b/app/modules/web/themes/material-blue/views/account/files-list.inc index 5c83bb54..c0eb5db5 100644 --- a/app/modules/web/themes/material-blue/views/account/files-list.inc +++ b/app/modules/web/themes/material-blue/views/account/files-list.inc @@ -19,14 +19,14 @@ use SP\Html\Html; ?>
  • + title="getName(), ENT_QUOTES); ?>"> attachment getName(), 50), $file->getSize() / 1024); ?> getThumb() !== 'no_thumb'): ?> - layers - name, $account->clientName); ?> + name, ENT_QUOTES), htmlspecialchars($account->clientName, ENT_QUOTES)); ?> getClientName())); ?> + class="mdl-chip__contact mdl-color-text--white"> + getClientName()), ENT_QUOTES); ?> + getShortClientName()); ?> + title="getClientName(), ENT_QUOTES); ?>"> + getShortClientName(), ENT_QUOTES); ?> + getClientName())); ?> + class="mdl-chip__contact mdl-color-text--white"> + getClientName()), ENT_QUOTES); ?> + getShortClientName()); ?> + title="getClientName(), ENT_QUOTES); ?>"> + getShortClientName(), ENT_QUOTES); ?> +
    • @@ -67,23 +75,27 @@ $favoriteRouteOff = $_getvar('favoriteRouteOff'); class="btn-action" data-action-route="" data-item-id="getId(); ?>" - data-onclick="account/view">getName(); ?> + data-onclick="account/view">getName(), ENT_QUOTES); ?>
    - getName()); ?> + getName(), ENT_QUOTES); ?>
    -
    getCategoryName()); ?>
    +
    + getCategoryName(), ENT_QUOTES); ?> +
    isShow()): ?>
    -
    getShortLogin()); ?>
    +
    + getShortLogin(), ENT_QUOTES); ?> +
    @@ -91,7 +103,9 @@ $favoriteRouteOff = $_getvar('favoriteRouteOff'); isUrlIslink()): ?> getShortUrl(); ?> + title="getUrl()); ?>"> + getShortUrl(); ?> +
    getShortUrl(); ?>
    @@ -105,7 +119,9 @@ $favoriteRouteOff = $_getvar('favoriteRouteOff');
    getTags() as $tag): ?> name); ?> + data-tag-id="id; ?>"> + name, ENT_QUOTES); ?> +
    @@ -119,7 +135,9 @@ $favoriteRouteOff = $_getvar('favoriteRouteOff'); getIconWarning()->getIcon(); ?>     + class="mdl-tooltip mdl-tooltip--top"> + + getIsPrivate() === 1): ?> @@ -127,13 +145,17 @@ $favoriteRouteOff = $_getvar('favoriteRouteOff'); class="material-icons">lock     + class="mdl-tooltip mdl-tooltip--top"> + + getIsPrivateGroup() === 1): ?> lock_open + class="mdl-tooltip mdl-tooltip--top"> + + face @@ -158,7 +180,9 @@ $favoriteRouteOff = $_getvar('favoriteRouteOff'); data-status="">star     + class="mdl-tooltip mdl-tooltip--top"> + + star_border + class="mdl-tooltip mdl-tooltip--top"> + + getNotes() !== ''): ?> @@ -191,7 +217,11 @@ $favoriteRouteOff = $_getvar('favoriteRouteOff');
    - getNumFiles()); ?> + getNumFiles() + ); ?>
    @@ -204,9 +234,17 @@ $favoriteRouteOff = $_getvar('favoriteRouteOff');

    - getPublicLinkDateExpire())); ?> + getPublicLinkDateExpire()) + ); ?>
    - getPublicLinkTotalCountViews()); ?> + getPublicLinkTotalCountViews() + ); ?>

    @@ -215,7 +253,7 @@ $favoriteRouteOff = $_getvar('favoriteRouteOff'); isWikiMatch($wikiFilter)): ?> - library_books @@ -223,10 +261,10 @@ $favoriteRouteOff = $_getvar('favoriteRouteOff'); library_books - library_books @@ -247,7 +285,9 @@ $favoriteRouteOff = $_getvar('favoriteRouteOff'); class="btn-action material-icons getClassesAsString(), ' ', $action->getIcon()->getClass(); ?>" data-item-id="getId(); ?>" data-parent-id="getParentId(); ?>" - getData() as $dataName => $dataValue): printf('data-%s="%s"', $dataName, $dataValue); endforeach; ?>> + getData() as $dataName => $dataValue): + printf('data-%s="%s"', $dataName, $dataValue); + endforeach; ?>> getIcon()->getIcon(); ?>     getData() as $dataName => $dataValue): printf('data-%s="%s"', $dataName, $dataValue); endforeach; ?>> + getData() as $dataName => $dataValue): + printf('data-%s="%s"', $dataName, $dataValue); + endforeach; ?>> getIcon()->getIcon(); ?> + title="getTitle(); ?>"> + getIcon()->getIcon(); ?> +     getName(); ?> diff --git a/app/modules/web/themes/material-blue/views/account/search-searchbox.inc b/app/modules/web/themes/material-blue/views/account/search-searchbox.inc index c32cb7ff..06ddfa27 100644 --- a/app/modules/web/themes/material-blue/views/account/search-searchbox.inc +++ b/app/modules/web/themes/material-blue/views/account/search-searchbox.inc @@ -43,7 +43,7 @@ $pager = $data->getPager(); + value="getId(); ?>" isSelected() ? 'selected' : ''; ?>>getName(), ENT_QUOTES); ?> @@ -53,7 +53,7 @@ $pager = $data->getPager(); + value="getId(); ?>" isSelected() ? 'selected' : ''; ?>>getName(), ENT_QUOTES); ?> @@ -134,7 +134,7 @@ $pager = $data->getPager(); + value="getId(); ?>" isSelected() ? 'selected' : ''; ?>>getName(), ENT_QUOTES); ?> diff --git a/app/modules/web/themes/material-blue/views/common/aux-customfields.inc b/app/modules/web/themes/material-blue/views/common/aux-customfields.inc index 98c2b51c..5b45f7ab 100644 --- a/app/modules/web/themes/material-blue/views/common/aux-customfields.inc +++ b/app/modules/web/themes/material-blue/views/common/aux-customfields.inc @@ -15,7 +15,7 @@ $customFields = $_getvar('customFields'); foreach ($customFields as $index => $field):?> - definitionName; ?> + definitionName, ENT_QUOTES); ?> isEncrypted && $field->isValueEncrypted === true): ?> @@ -58,7 +58,7 @@ foreach ($customFields as $index => $field):?> maxlength="500" value="value) ? '***' : htmlspecialchars($field->value, ENT_QUOTES); ?>" required ? 'required' : ''; ?> > + for="formId; ?>">definitionName, ENT_QUOTES); ?> typeName === 'textarea'): ?>
    @@ -68,7 +68,7 @@ foreach ($customFields as $index => $field):?> name="customfield[definitionId; ?>]" id="formId; ?>" >value, ENT_QUOTES); ?> + for="formId; ?>">definitionName, ENT_QUOTES); ?>
    @@ -79,7 +79,7 @@ foreach ($customFields as $index => $field):?> maxlength="500" value="value, ENT_QUOTES); ?>" required ? 'required' : ''; ?> > + for="formId; ?>">definitionName, ENT_QUOTES); ?>
    diff --git a/app/modules/web/themes/material-blue/views/config/encryption.inc b/app/modules/web/themes/material-blue/views/config/encryption.inc index d037f2bb..0eb67ca6 100644 --- a/app/modules/web/themes/material-blue/views/config/encryption.inc +++ b/app/modules/web/themes/material-blue/views/config/encryption.inc @@ -306,7 +306,7 @@ $disabled = $configData->isMaintenance() ? '' : 'disabled'; + value="getId(); ?>">getName(), ENT_QUOTES); ?> diff --git a/app/modules/web/themes/material-blue/views/config/general-auth.inc b/app/modules/web/themes/material-blue/views/config/general-auth.inc index acb2c40f..7838755c 100644 --- a/app/modules/web/themes/material-blue/views/config/general-auth.inc +++ b/app/modules/web/themes/material-blue/views/config/general-auth.inc @@ -100,7 +100,7 @@ use SP\Mvc\View\Template; + value="getId(); ?>" getId() === $configData->getSsoDefaultGroup() ? 'selected' : ''; ?>>getName(), ENT_QUOTES); ?> @@ -126,7 +126,7 @@ use SP\Mvc\View\Template; + value="getId(); ?>" getId() === $configData->getSsoDefaultProfile()) ? 'selected' : ''; ?>>getName(), ENT_QUOTES); ?> diff --git a/app/modules/web/themes/material-blue/views/config/import.inc b/app/modules/web/themes/material-blue/views/config/import.inc index b028ade5..335102e4 100644 --- a/app/modules/web/themes/material-blue/views/config/import.inc +++ b/app/modules/web/themes/material-blue/views/config/import.inc @@ -40,7 +40,7 @@ use SP\Mvc\View\Template; foreach ($_getvar('users') as $user): ?> @@ -68,7 +68,7 @@ use SP\Mvc\View\Template; foreach ($_getvar('userGroups') as $userGroup): ?> diff --git a/app/modules/web/themes/material-blue/views/config/ldap.inc b/app/modules/web/themes/material-blue/views/config/ldap.inc index f227ec05..cc08965c 100644 --- a/app/modules/web/themes/material-blue/views/config/ldap.inc +++ b/app/modules/web/themes/material-blue/views/config/ldap.inc @@ -322,7 +322,7 @@ use SP\Mvc\View\Template; @@ -353,7 +353,7 @@ use SP\Mvc\View\Template; @@ -461,9 +461,9 @@ use SP\Mvc\View\Template; @@ -495,9 +495,9 @@ use SP\Mvc\View\Template; diff --git a/app/modules/web/themes/material-blue/views/config/wiki-dokuwiki.inc b/app/modules/web/themes/material-blue/views/config/wiki-dokuwiki.inc index 24db080b..075b40c2 100644 --- a/app/modules/web/themes/material-blue/views/config/wiki-dokuwiki.inc +++ b/app/modules/web/themes/material-blue/views/config/wiki-dokuwiki.inc @@ -180,7 +180,7 @@ use SP\Mvc\View\Template; type="text" class="mdl-textfield__input mdl-color-text--indigo-400" maxlength="128" - value="getDokuwikiNamespace(); ?>"/> + value="getDokuwikiNamespace(), ENT_QUOTES); ?>"/> diff --git a/app/modules/web/themes/material-blue/views/itemshow/account_bulkedit.inc b/app/modules/web/themes/material-blue/views/itemshow/account_bulkedit.inc index 2d360133..a4bfc97b 100644 --- a/app/modules/web/themes/material-blue/views/itemshow/account_bulkedit.inc +++ b/app/modules/web/themes/material-blue/views/itemshow/account_bulkedit.inc @@ -50,7 +50,7 @@ use SP\Mvc\View\Template; + value="getId(); ?>">getName(), ENT_QUOTES); ?> @@ -66,7 +66,7 @@ use SP\Mvc\View\Template; + value="getId(); ?>">getName(), ENT_QUOTES); ?> @@ -82,7 +82,7 @@ use SP\Mvc\View\Template; + value="getId(); ?>">getName(), ENT_QUOTES); ?> @@ -98,7 +98,7 @@ use SP\Mvc\View\Template; + value="getId(); ?>">getName(), ENT_QUOTES); ?> @@ -111,7 +111,7 @@ use SP\Mvc\View\Template; class="select-box-tags"> - + @@ -135,7 +135,7 @@ use SP\Mvc\View\Template; + value="getId(); ?>">getName(), ENT_QUOTES); ?> @@ -160,7 +160,7 @@ use SP\Mvc\View\Template; + value="getId(); ?>">getName(), ENT_QUOTES); ?> @@ -192,7 +192,7 @@ use SP\Mvc\View\Template; + value="getId(); ?>">getName(), ENT_QUOTES); ?> @@ -217,7 +217,7 @@ use SP\Mvc\View\Template; + value="getId(); ?>">getName(), ENT_QUOTES); ?> diff --git a/app/modules/web/themes/material-blue/views/itemshow/auth_token.inc b/app/modules/web/themes/material-blue/views/itemshow/auth_token.inc index deb3d5fd..b38e1443 100644 --- a/app/modules/web/themes/material-blue/views/itemshow/auth_token.inc +++ b/app/modules/web/themes/material-blue/views/itemshow/auth_token.inc @@ -34,7 +34,7 @@ $authToken = $_getvar('authToken'); - + @@ -50,7 +50,7 @@ $authToken = $_getvar('authToken'); - + diff --git a/app/modules/web/themes/material-blue/views/itemshow/category.inc b/app/modules/web/themes/material-blue/views/itemshow/category.inc index 9d0d286b..8ded44fb 100644 --- a/app/modules/web/themes/material-blue/views/itemshow/category.inc +++ b/app/modules/web/themes/material-blue/views/itemshow/category.inc @@ -31,7 +31,7 @@ $category = $_getvar('category'); + value="getName(), ENT_QUOTES); ?>"> @@ -44,7 +44,7 @@ $category = $_getvar('category'); + value="getDescription(), ENT_QUOTES); ?>"> diff --git a/app/modules/web/themes/material-blue/views/itemshow/client.inc b/app/modules/web/themes/material-blue/views/itemshow/client.inc index f712e907..21f3ea08 100644 --- a/app/modules/web/themes/material-blue/views/itemshow/client.inc +++ b/app/modules/web/themes/material-blue/views/itemshow/client.inc @@ -31,7 +31,7 @@ $client = $_getvar('client'); + value="getName(), ENT_QUOTES); ?>"> @@ -45,7 +45,7 @@ $client = $_getvar('client'); + value="getDescription(), ENT_QUOTES); ?>"> diff --git a/app/modules/web/themes/material-blue/views/itemshow/custom_field.inc b/app/modules/web/themes/material-blue/views/itemshow/custom_field.inc index 62b4a021..61cf0a1c 100644 --- a/app/modules/web/themes/material-blue/views/itemshow/custom_field.inc +++ b/app/modules/web/themes/material-blue/views/itemshow/custom_field.inc @@ -33,7 +33,7 @@ $field = $_getvar('field'); + value="getName(), ENT_QUOTES); ?>"> diff --git a/app/modules/web/themes/material-blue/views/itemshow/file.inc b/app/modules/web/themes/material-blue/views/itemshow/file.inc index bdccb6e9..78b439da 100644 --- a/app/modules/web/themes/material-blue/views/itemshow/file.inc +++ b/app/modules/web/themes/material-blue/views/itemshow/file.inc @@ -17,7 +17,7 @@ $fileData = $_getvar('fileData'); -
    getName(); ?>
    +
    getName(), ENT_QUOTES); ?>
    \ No newline at end of file diff --git a/app/modules/web/themes/material-blue/views/itemshow/item_preset-password.inc b/app/modules/web/themes/material-blue/views/itemshow/item_preset-password.inc index 86899e38..f8fd3337 100644 --- a/app/modules/web/themes/material-blue/views/itemshow/item_preset-password.inc +++ b/app/modules/web/themes/material-blue/views/itemshow/item_preset-password.inc @@ -65,7 +65,7 @@ $password = $_getvar('password');
    + value="getRegex(), ENT_QUOTES); ?>"/>
    diff --git a/app/modules/web/themes/material-blue/views/itemshow/item_preset-permission.inc b/app/modules/web/themes/material-blue/views/itemshow/item_preset-permission.inc index 04dff8a3..17a351d2 100644 --- a/app/modules/web/themes/material-blue/views/itemshow/item_preset-permission.inc +++ b/app/modules/web/themes/material-blue/views/itemshow/item_preset-permission.inc @@ -27,7 +27,7 @@ use SP\Mvc\View\Template; isSkip()): continue; endif; ?> + isSelected() ? 'selected' : '' ?>>getName(), ENT_QUOTES); ?> @@ -45,7 +45,7 @@ use SP\Mvc\View\Template; isSkip()): continue; endif; ?> + isSelected() ? 'selected' : '' ?>>getName(), ENT_QUOTES); ?> @@ -70,7 +70,7 @@ use SP\Mvc\View\Template; isSkip()): continue; endif; ?> + isSelected() ? 'selected' : '' ?>>getName(), ENT_QUOTES); ?> @@ -88,7 +88,7 @@ use SP\Mvc\View\Template; isSkip()): continue; endif; ?> + isSelected() ? 'selected' : '' ?>>getName(), ENT_QUOTES); ?> diff --git a/app/modules/web/themes/material-blue/views/itemshow/item_preset.inc b/app/modules/web/themes/material-blue/views/itemshow/item_preset.inc index b144ad02..d1bed86f 100644 --- a/app/modules/web/themes/material-blue/views/itemshow/item_preset.inc +++ b/app/modules/web/themes/material-blue/views/itemshow/item_preset.inc @@ -48,7 +48,7 @@ $preset = $_getvar('preset'); + value="getId(); ?>" isSelected() ? 'selected' : ''; ?>>getName(), ENT_QUOTES); ?> @@ -66,7 +66,7 @@ $preset = $_getvar('preset'); + value="getId(); ?>" isSelected() ? 'selected' : ''; ?>>getName(), ENT_QUOTES); ?> @@ -84,7 +84,7 @@ $preset = $_getvar('preset'); + value="getId(); ?>" isSelected() ? 'selected' : ''; ?>>getName(), ENT_QUOTES); ?> diff --git a/app/modules/web/themes/material-blue/views/itemshow/public_link.inc b/app/modules/web/themes/material-blue/views/itemshow/public_link.inc index 457ace84..72b685d6 100644 --- a/app/modules/web/themes/material-blue/views/itemshow/public_link.inc +++ b/app/modules/web/themes/material-blue/views/itemshow/public_link.inc @@ -35,7 +35,14 @@ $publicLink = $_getvar('publicLink'); + value="getId(); ?>" + isSelected() ? 'selected' : ''; ?>> + getName(), ENT_QUOTES), + htmlspecialchars($account->getItemProperty('clientName'), ENT_QUOTES) + ); ?> + diff --git a/app/modules/web/themes/material-blue/views/itemshow/tag.inc b/app/modules/web/themes/material-blue/views/itemshow/tag.inc index 2281c68e..ada5ccf8 100644 --- a/app/modules/web/themes/material-blue/views/itemshow/tag.inc +++ b/app/modules/web/themes/material-blue/views/itemshow/tag.inc @@ -30,7 +30,7 @@ $tag = $_getvar('tag'); + value="getName(), ENT_QUOTES); ?>"> diff --git a/app/modules/web/themes/material-blue/views/itemshow/user.inc b/app/modules/web/themes/material-blue/views/itemshow/user.inc index 9b33b0cc..9f7584fb 100644 --- a/app/modules/web/themes/material-blue/views/itemshow/user.inc +++ b/app/modules/web/themes/material-blue/views/itemshow/user.inc @@ -48,7 +48,7 @@ $user = $_getvar('user'); > @@ -63,7 +63,7 @@ $user = $_getvar('user'); isLdap() ? 'readonly' : $_getvar('readonly'); ?>> @@ -83,7 +83,7 @@ $user = $_getvar('user'); > @@ -99,7 +99,7 @@ $user = $_getvar('user'); > @@ -153,7 +153,7 @@ $user = $_getvar('user'); + value="getId(); ?>" getId() === $user->getUserProfileId()) ? 'selected' : ''; ?>>getName(), ENT_QUOTES); ?> @@ -171,7 +171,7 @@ $user = $_getvar('user'); + value="getId(); ?>" getId() === $user->getUserGroupId()) ? 'selected' : ''; ?>>getName(), ENT_QUOTES); ?> @@ -183,7 +183,9 @@ $user = $_getvar('user');
    + maxlength="1000" > + getNotes(), ENT_QUOTES); ?> +
    @@ -338,7 +340,11 @@ $user = $_getvar('user'); title="ref; ?>"> icon; ?> - ref, htmlentities($item->name) ?: $item->id); ?> + ref, + htmlspecialchars($item->name, ENT_QUOTES) ?: $item->id + ); ?> diff --git a/app/modules/web/themes/material-blue/views/itemshow/user_group.inc b/app/modules/web/themes/material-blue/views/itemshow/user_group.inc index dcf7d947..89d24ddb 100644 --- a/app/modules/web/themes/material-blue/views/itemshow/user_group.inc +++ b/app/modules/web/themes/material-blue/views/itemshow/user_group.inc @@ -34,7 +34,7 @@ $group = $_getvar('group'); + value="getName(), ENT_QUOTES); ?>"> @@ -48,7 +48,7 @@ $group = $_getvar('group'); + value="getDescription(), ENT_QUOTES); ?>"> @@ -68,7 +68,10 @@ $group = $_getvar('group'); + value="getId(); ?>" + isSelected() ? 'selected' : ''; ?>> + getName(), ENT_QUOTES); ?> + @@ -78,7 +81,9 @@ $group = $_getvar('group'); isSelected()): ?> - getName()); ?> + + getName(), ENT_QUOTES); ?> + @@ -106,9 +111,17 @@ $group = $_getvar('group'); person ref === 'UserGroup'): ?> - name), htmlentities($user->login)); ?> + name, ENT_QUOTES), + htmlspecialchars($user->login, ENT_QUOTES) + ); ?> - name), htmlentities($user->login)); ?> + name, ENT_QUOTES), + htmlspecialchars($user->login, ENT_QUOTES) + ); ?> diff --git a/app/modules/web/themes/material-blue/views/itemshow/user_pass.inc b/app/modules/web/themes/material-blue/views/itemshow/user_pass.inc index 1b7b9519..66fc0aa5 100644 --- a/app/modules/web/themes/material-blue/views/itemshow/user_pass.inc +++ b/app/modules/web/themes/material-blue/views/itemshow/user_pass.inc @@ -29,7 +29,7 @@ $user = $_getvar('user');
    @@ -41,7 +41,7 @@ $user = $_getvar('user');
    diff --git a/app/modules/web/themes/material-blue/views/itemshow/user_profile.inc b/app/modules/web/themes/material-blue/views/itemshow/user_profile.inc index ba257e19..c2a62db4 100644 --- a/app/modules/web/themes/material-blue/views/itemshow/user_profile.inc +++ b/app/modules/web/themes/material-blue/views/itemshow/user_profile.inc @@ -578,7 +578,7 @@ $profileData = $_getvar('profileData'); > diff --git a/app/modules/web/themes/material-blue/views/notification/notification.inc b/app/modules/web/themes/material-blue/views/notification/notification.inc index b1fe5d4f..87a4697b 100644 --- a/app/modules/web/themes/material-blue/views/notification/notification.inc +++ b/app/modules/web/themes/material-blue/views/notification/notification.inc @@ -1,10 +1,10 @@ getDate()); ?>" > + value="getDate()); ?>" + > @@ -76,13 +77,15 @@ $notification = $_getvar('notification'); class="mdl-textfield__input mdl-color-text--indigo-400" type="text" rows="3" id="notification_description" - name="notification_description" >getDescription(); ?> + name="notification_description" > + getDescription(), ENT_QUOTES); ?> +
    - getDescription(); ?> + getDescription(), ENT_QUOTES); ?>
    @@ -99,8 +102,10 @@ $notification = $_getvar('notification'); - + @@ -114,7 +119,8 @@ $notification = $_getvar('notification'); title=""> isSticky() ? 'checked' : ' '; ?> /> + name="notification_sticky" isSticky() ? 'checked' + : ' '; ?> /> @@ -123,7 +129,9 @@ $notification = $_getvar('notification'); title=""> isOnlyAdmin() ? 'checked' : ' '; ?> /> + name="notification_onlyadmin" + isOnlyAdmin() ? 'checked' : ' '; ?> + /> @@ -132,7 +140,9 @@ $notification = $_getvar('notification'); title=""> isChecked() ? 'checked' : ' '; ?> /> + name="notification_checkout" + isChecked() ? 'checked' : ' '; ?> + /> @@ -145,7 +155,8 @@ $notification = $_getvar('notification');