diff --git a/apps/calendar/index.php b/apps/calendar/index.php index cf03a7a3cd..05a808a5ae 100644 --- a/apps/calendar/index.php +++ b/apps/calendar/index.php @@ -54,9 +54,9 @@ OCP\Util::addscript('contacts','jquery.multi-autocomplete'); OCP\Util::addscript('','oc-vcategories'); OCP\App::setActiveNavigationEntry('calendar_index'); $tmpl = new OCP\Template('calendar', 'calendar', 'user'); -$tmpl->assign('eventSources', $eventSources); +$tmpl->assign('eventSources', $eventSources,false); $tmpl->assign('categories', $categories); if(array_key_exists('showevent', $_GET)){ - $tmpl->assign('showevent', $_GET['showevent']); + $tmpl->assign('showevent', $_GET['showevent'], false); } $tmpl->printPage(); diff --git a/apps/calendar/lib/app.php b/apps/calendar/lib/app.php index 2cd28c0f78..ff7ad1cb93 100644 --- a/apps/calendar/lib/app.php +++ b/apps/calendar/lib/app.php @@ -377,8 +377,8 @@ class OC_Calendar_App{ $lastmodified = ($last_modified)?$last_modified->getDateTime()->format('U'):0; $output = array('id'=>(int)$event['id'], - 'title' => htmlspecialchars(($event['summary']!=NULL || $event['summary'] != '')?$event['summary']: self::$l10n->t('unnamed')), - 'description' => isset($vevent->DESCRIPTION)?htmlspecialchars($vevent->DESCRIPTION->value):'', + 'title' => ($event['summary']!=NULL || $event['summary'] != '')?$event['summary']: self::$l10n->t('unnamed'), + 'description' => isset($vevent->DESCRIPTION)?$vevent->DESCRIPTION->value:'', 'lastmodified'=>$lastmodified); $dtstart = $vevent->DTSTART; diff --git a/apps/calendar/templates/part.choosecalendar.rowfields.php b/apps/calendar/templates/part.choosecalendar.rowfields.php index 268c335601..965523f847 100644 --- a/apps/calendar/templates/part.choosecalendar.rowfields.php +++ b/apps/calendar/templates/part.choosecalendar.rowfields.php @@ -1,8 +1,8 @@ '; -echo ''; +echo ''; echo ''; -echo ''; +echo ''; echo ''; echo ''; echo ''; diff --git a/apps/calendar/templates/part.choosecalendar.rowfields.shared.php b/apps/calendar/templates/part.choosecalendar.rowfields.shared.php index 6a212858a2..a23266da0c 100644 --- a/apps/calendar/templates/part.choosecalendar.rowfields.shared.php +++ b/apps/calendar/templates/part.choosecalendar.rowfields.shared.php @@ -1,4 +1,4 @@ '; -echo ''; +echo ''; echo '' . $l->t('shared with you by') . ' ' . $_['share']['owner'] . ''; \ No newline at end of file diff --git a/apps/calendar/templates/part.eventform.php b/apps/calendar/templates/part.eventform.php index 2d86ce4d31..95eecf2622 100644 --- a/apps/calendar/templates/part.eventform.php +++ b/apps/calendar/templates/part.eventform.php @@ -18,7 +18,7 @@ echo 'Calendar.UI.Share.idtype = "event";' . "\n" . 'Calendar.UI.Share.currentid t("Title");?>: - " value="" maxlength="100" name="title"/> + " value="" maxlength="100" name="title"/> @@ -26,7 +26,7 @@ echo 'Calendar.UI.Share.idtype = "event";' . "\n" . 'Calendar.UI.Share.currentid t("Category");?>: - + <?php echo $l->t('Edit categories'); ?> 1) { ?> @@ -80,7 +80,7 @@ echo 'Calendar.UI.Share.idtype = "event";' . "\n" . 'Calendar.UI.Share.currentid t("Location");?>: - " value="" maxlength="100" name="location" /> + " value="" maxlength="100" name="location" /> @@ -88,7 +88,7 @@ echo 'Calendar.UI.Share.idtype = "event";' . "\n" . 'Calendar.UI.Share.currentid t("Description");?>: - + diff --git a/apps/calendar/templates/part.import.php b/apps/calendar/templates/part.import.php index b966100cc1..70ff961215 100644 --- a/apps/calendar/templates/part.import.php +++ b/apps/calendar/templates/part.import.php @@ -9,7 +9,7 @@ $calendar_options = OC_Calendar_Calendar::allCalendars(OCP\USER::getUser()); $calendar_options[] = array('id'=>'newcal', 'displayname'=>$l->t('create a new calendar')); for($i = 0;$i'id', 'label'=>'displayname')); ?> diff --git a/apps/calendar/templates/part.showevent.php b/apps/calendar/templates/part.showevent.php index 3646baf5bb..a5bbfd5b8f 100644 --- a/apps/calendar/templates/part.showevent.php +++ b/apps/calendar/templates/part.showevent.php @@ -10,7 +10,7 @@ t("Title");?>: - + @@ -79,7 +79,7 @@ t("Location");?>: - + @@ -87,7 +87,7 @@ t("Description");?>: - + diff --git a/apps/contacts/templates/part.contacts.php b/apps/contacts/templates/part.contacts.php index 5751750540..00a61f72fd 100644 --- a/apps/contacts/templates/part.contacts.php +++ b/apps/contacts/templates/part.contacts.php @@ -8,5 +8,5 @@ } } ?> -
    • +
    • diff --git a/apps/files/ajax/list.php b/apps/files/ajax/list.php index ceb8d15858..f0600a179d 100644 --- a/apps/files/ajax/list.php +++ b/apps/files/ajax/list.php @@ -38,7 +38,7 @@ foreach( OC_Files::getdirectorycontent( $dir ) as $i ){ } $list = new OCP\Template( "files", "part.list", "" ); -$list->assign( "files", $files ); +$list->assign( "files", $files, false ); $data = array('files' => $list->fetchPage()); OCP\JSON::success(array('data' => $data)); diff --git a/apps/files/index.php b/apps/files/index.php index 60a3836cb5..ed36c5edab 100644 --- a/apps/files/index.php +++ b/apps/files/index.php @@ -73,12 +73,12 @@ foreach( explode( '/', $dir ) as $i ){ // make breadcrumb und filelist markup $list = new OCP\Template( 'files', 'part.list', '' ); -$list->assign( 'files', $files ); -$list->assign( 'baseURL', OCP\Util::linkTo('files', 'index.php').'&dir='); -$list->assign( 'downloadURL', OCP\Util::linkTo('files', 'download.php').'?file='); +$list->assign( 'files', $files, false ); +$list->assign( 'baseURL', OCP\Util::linkTo('files', 'index.php').'&dir=', false); +$list->assign( 'downloadURL', OCP\Util::linkTo('files', 'download.php').'?file=', false); $breadcrumbNav = new OCP\Template( 'files', 'part.breadcrumb', '' ); -$breadcrumbNav->assign( 'breadcrumb', $breadcrumb ); -$breadcrumbNav->assign( 'baseURL', OCP\Util::linkTo('files', 'index.php').'&dir='); +$breadcrumbNav->assign( 'breadcrumb', $breadcrumb, false ); +$breadcrumbNav->assign( 'baseURL', OCP\Util::linkTo('files', 'index.php').'&dir=', false); $upload_max_filesize = OCP\Util::computerFileSize(ini_get('upload_max_filesize')); $post_max_size = OCP\Util::computerFileSize(ini_get('post_max_size')); @@ -89,8 +89,8 @@ $freeSpace=max($freeSpace,0); $maxUploadFilesize = min($maxUploadFilesize ,$freeSpace); $tmpl = new OCP\Template( 'files', 'index', 'user' ); -$tmpl->assign( 'fileList', $list->fetchPage() ); -$tmpl->assign( 'breadcrumb', $breadcrumbNav->fetchPage() ); +$tmpl->assign( 'fileList', $list->fetchPage(), false ); +$tmpl->assign( 'breadcrumb', $breadcrumbNav->fetchPage(), false ); $tmpl->assign( 'dir', $dir); $tmpl->assign( 'readonly', !OC_Filesystem::is_writable($dir.'/')); $tmpl->assign( 'files', $files ); diff --git a/apps/files/templates/index.php b/apps/files/templates/index.php index 3bd5a1ceef..44000171a1 100644 --- a/apps/files/templates/index.php +++ b/apps/files/templates/index.php @@ -15,7 +15,7 @@
    - + diff --git a/apps/files_external/templates/settings.php b/apps/files_external/templates/settings.php index a995ee3419..6c37df8001 100644 --- a/apps/files_external/templates/settings.php +++ b/apps/files_external/templates/settings.php @@ -16,7 +16,7 @@ array())); ?> $mount): ?> > - +
    - + <?php echo $l->t('Edit categories'); ?>
    diff --git a/apps/user_ldap/settings.php b/apps/user_ldap/settings.php index 0c29e70b5a..42084855e8 100644 --- a/apps/user_ldap/settings.php +++ b/apps/user_ldap/settings.php @@ -47,7 +47,7 @@ if ($_POST) { // fill template $tmpl = new OCP\Template( 'user_ldap', 'settings'); foreach($params as $param){ - $value = htmlentities(OCP\Config::getAppValue('user_ldap', $param,'')); + $value = OCP\Config::getAppValue('user_ldap', $param,''); $tmpl->assign($param, $value); } diff --git a/apps/user_openid/settings.php b/apps/user_openid/settings.php index 062322f6fe..921fa371dd 100644 --- a/apps/user_openid/settings.php +++ b/apps/user_openid/settings.php @@ -2,7 +2,7 @@ $tmpl = new OCP\Template( 'user_openid', 'settings'); $identity=OCP\Config::getUserValue(OCP\USER::getUser(),'user_openid','identity',''); -$tmpl->assign('identity',htmlentities($identity)); +$tmpl->assign('identity',$identity); OCP\Util::addscript('user_openid','settings'); diff --git a/core/templates/404.php b/core/templates/404.php index cd4f2b40bb..13a8101034 100644 --- a/core/templates/404.php +++ b/core/templates/404.php @@ -10,6 +10,6 @@ if(!isset($_)){//also provide standalone error page diff --git a/core/templates/login.php b/core/templates/login.php index 41d6ba41ef..a40bf5c330 100644 --- a/core/templates/login.php +++ b/core/templates/login.php @@ -1,7 +1,7 @@
    - '; } ?> + '; } ?> t('Lost your password?'); ?> diff --git a/lib/template.php b/lib/template.php index 9ce041a71c..a3700e133e 100644 --- a/lib/template.php +++ b/lib/template.php @@ -262,6 +262,7 @@ class OC_Template{ * @brief Assign variables * @param $key key * @param $value value + * @param $sanitizeHTML false, if data shouldn't get passed through htmlentities * @returns true * * This function assigns a variable. It can be accessed via $_[$key] in @@ -269,11 +270,29 @@ class OC_Template{ * * If the key existed before, it will be overwritten */ - public function assign( $key, $value ){ + public function assign( $key, $value, $sanitizeHTML=true ){ + if($sanitizeHTML == true) { + if(is_array($value)) { + array_walk_recursive($value,'OC_Template::sanitizeHTML'); + } else { + $value = OC_Template::sanitizeHTML($value); + } + } $this->vars[$key] = $value; return true; } + + /** + * @brief Internaly used to sanitze HTML + * + * This function is internally used to sanitize HTML. + */ + private static function sanitizeHTML( &$value ){ + $value = htmlentities( $value ); + return $value; + } + /** * @brief Appends a variable * @param $key key @@ -357,21 +376,21 @@ class OC_Template{ // Decide which page we show if( $this->renderas == "user" ){ $page = new OC_Template( "core", "layout.user" ); - $page->assign('searchurl',OC_Helper::linkTo( 'search', 'index.php' )); + $page->assign('searchurl',OC_Helper::linkTo( 'search', 'index.php' ), false); $page->assign('requesttoken', $this->vars['requesttoken']); if(array_search(OC_APP::getCurrentApp(),array('settings','admin','help'))!==false){ - $page->assign('bodyid','body-settings'); + $page->assign('bodyid','body-settings', false); }else{ - $page->assign('bodyid','body-user'); + $page->assign('bodyid','body-user', false); } // Add navigation entry $navigation = OC_App::getNavigation(); - $page->assign( "navigation", $navigation); - $page->assign( "settingsnavigation", OC_App::getSettingsNavigation()); + $page->assign( "navigation", $navigation, false); + $page->assign( "settingsnavigation", OC_App::getSettingsNavigation(), false); foreach($navigation as $entry) { if ($entry['active']) { - $page->assign( 'application', $entry['name'] ); + $page->assign( 'application', $entry['name'], false ); break; } } @@ -385,7 +404,7 @@ class OC_Template{ // Read the detected formfactor and use the right file name. $fext = self::getFormFactorExtension(); - $page->assign('jsfiles', array()); + $page->assign('jsfiles', array(), false); // Add the core js files or the js files provided by the selected theme foreach(OC_Util::$scripts as $script){ // Is it in 3rd party? @@ -460,13 +479,13 @@ class OC_Template{ } // Add custom headers - $page->assign('headers',$this->headers); + $page->assign('headers',$this->headers, false); foreach(OC_Util::$headers as $header){ $page->append('headers',$header); } // Add css files and js files - $page->assign( "content", $data ); + $page->assign( "content", $data, false ); return $page->fetchPage(); } else{ @@ -511,13 +530,13 @@ class OC_Template{ $_ = array_merge( $additionalparams, $this->vars ); } - // Einbinden + // Include ob_start(); include( $this->path.$file.'.php' ); $data = ob_get_contents(); @ob_end_clean(); - // Daten zurückgeben + // Return data return $data; } @@ -531,7 +550,7 @@ class OC_Template{ public static function printUserPage( $application, $name, $parameters = array() ){ $content = new OC_Template( $application, $name, "user" ); foreach( $parameters as $key => $value ){ - $content->assign( $key, $value ); + $content->assign( $key, $value, false ); } print $content->printPage(); } @@ -546,7 +565,7 @@ class OC_Template{ public static function printAdminPage( $application, $name, $parameters = array() ){ $content = new OC_Template( $application, $name, "admin" ); foreach( $parameters as $key => $value ){ - $content->assign( $key, $value ); + $content->assign( $key, $value, false ); } return $content->printPage(); } @@ -561,7 +580,7 @@ class OC_Template{ public static function printGuestPage( $application, $name, $parameters = array() ){ $content = new OC_Template( $application, $name, "guest" ); foreach( $parameters as $key => $value ){ - $content->assign( $key, $value ); + $content->assign( $key, $value,false ); } return $content->printPage(); } diff --git a/settings/admin.php b/settings/admin.php index a997bad4e3..4cbd67c367 100644 --- a/settings/admin.php +++ b/settings/admin.php @@ -23,7 +23,7 @@ function compareEntries($a,$b){ usort($entries, 'compareEntries'); $tmpl->assign('loglevel',OC_Config::getValue( "loglevel", 2 )); -$tmpl->assign('entries',$entries); +$tmpl->assign('entries',$entries,false); $tmpl->assign('forms',array()); foreach($forms as $form){ $tmpl->append('forms',$form); diff --git a/settings/apps.php b/settings/apps.php index 7908e6cc18..f85b28158f 100644 --- a/settings/apps.php +++ b/settings/apps.php @@ -92,7 +92,7 @@ usort($apps, 'app_sort'); $tmpl = new OC_Template( "settings", "apps", "user" ); -$tmpl->assign('apps',$apps); +$tmpl->assign('apps',$apps, false); $tmpl->printPage(); diff --git a/settings/templates/admin.php b/settings/templates/admin.php index d167f2780e..38c6042c82 100644 --- a/settings/templates/admin.php +++ b/settings/templates/admin.php @@ -29,7 +29,7 @@ $levels=array('Debug','Info','Warning','Error','Fatal'); app;?> - message);?> + message;?> time);?> diff --git a/settings/templates/help.php b/settings/templates/help.php index cf61207e60..a53ec76d68 100644 --- a/settings/templates/help.php +++ b/settings/templates/help.php @@ -26,9 +26,9 @@
    "") { echo(''); } ?> - '') echo('

    '.htmlentities($kb["name"]).'

    ');?> -

    - '') echo('

    '.$l->t('Answer').':

    '.htmlentities($kb['answer']).'

    ');?> + '') echo('

    '.$kb["name"].'

    ');?> +

    + '') echo('

    '.$l->t('Answer').':

    '.$kb['answer'].'

    ');?>