From 08100f68ae9daeb1598cf7e623f6680c6191db94 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=B4me=20Bernigaud?= <come.bernigaud@opensides.be>
Date: Tue, 7 Oct 2014 11:38:18 +0200
Subject: [PATCH] Fixes #3369 escaping html entities in img srcs
---
ihtml/themes/default/framework.tpl | 8 ++++----
ihtml/themes/default/setup_header.tpl | 6 ++++--
include/class_management.inc | 2 +-
include/class_pluglist.inc | 6 +++---
include/functions.inc | 12 ++++++------
plugins/personal/generic/class_user.inc | 4 ++--
setup/setup_frame.tpl | 4 ++--
7 files changed, 22 insertions(+), 20 deletions(-)
diff --git a/ihtml/themes/default/framework.tpl b/ihtml/themes/default/framework.tpl
index 0c79bc62c..299d42975 100644
--- a/ihtml/themes/default/framework.tpl
+++ b/ihtml/themes/default/framework.tpl
@@ -5,16 +5,16 @@
<form action="main.php{$plug}" name="mainform" id="mainform" method="post" enctype="multipart/form-data">
<div class="setup_header">
<div id="header_left">
- <img id="fd_logo" class="optional" src="geticon.php?context=applications&icon=fusiondirectory&size=48" alt="FusionDirectory"/>
+ <img id="fd_logo" class="optional" src="geticon.php?context=applications&icon=fusiondirectory&size=48" alt="FusionDirectory"/>
<a class="maintitlebar" href="main.php?reset=1">
- <img src="geticon.php?context=actions&icon=go-home&size=22" alt="Main"/> {t}Main{/t}
+ <img src="geticon.php?context=actions&icon=go-home&size=22" alt="Main"/> {t}Main{/t}
</a>
<a class="maintitlebar logout" href="logout.php?request">
- <img src="geticon.php?context=actions&icon=application-exit&size=22" alt="Sign out"/> {t}Sign out{/t}
+ <img src="geticon.php?context=actions&icon=application-exit&size=22" alt="Sign out"/> {t}Sign out{/t}
</a>
<a class="plugtop">
- <img src="{$headline_image}" alt="{t}{$headline}{/t}"/>{t}{$headline}{/t}
+ <img src="{$headline_image|escape}" alt="{t}{$headline}{/t}"/>{t}{$headline}{/t}
</a>
</div>
<div id="header_right">
diff --git a/ihtml/themes/default/setup_header.tpl b/ihtml/themes/default/setup_header.tpl
index f313e4544..bc05ae9ec 100644
--- a/ihtml/themes/default/setup_header.tpl
+++ b/ihtml/themes/default/setup_header.tpl
@@ -1,6 +1,8 @@
{$php_errors}
-<div class='setup_header'>
- <div style="float:left;"><img src='geticon.php?context=applications&icon=fusiondirectory&size=48' class='center' alt='FusionDirectory' /></div>
+<div class="setup_header">
+ <div style="float:left;">
+ <img src="geticon.php?context=applications&icon=fusiondirectory&size=48" class="center" alt="FusionDirectory" />
+ </div>
<div style="padding-top:8px;text-align:right;height:38px;color:#000000;font-size:20px">{$version}</div>
</div>
diff --git a/include/class_management.inc b/include/class_management.inc
index d4d0eb189..dc5174ef3 100644
--- a/include/class_management.inc
+++ b/include/class_management.inc
@@ -261,7 +261,7 @@ class management
}
if (get_object_info() != "") {
$display = print_header($plIcon, _($plDescription),
- '<img alt="" class="center" src="geticon.php?context=status&icon=object-locked&size=16"/>'.
+ '<img alt="" class="center" src="geticon.php?context=status&icon=object-locked&size=16"/>'.
LDAP::fix(get_object_info()));
} else {
$display = print_header($plIcon, _($plDescription));
diff --git a/include/class_pluglist.inc b/include/class_pluglist.inc
index bafff70d8..6b19eb485 100644
--- a/include/class_pluglist.inc
+++ b/include/class_pluglist.inc
@@ -298,10 +298,9 @@ class pluglist {
function gen_menu()
{
if ($this->menu == "") {
- $this->menu = '<ul class="menu">';
+ $this->menu = '<ul class="menu">'."\n";
/* Parse headlines */
foreach ($this->config->data['SECTIONS'] as $section => $section_infos) {
- //~ $menu = '<p class="menuheader">'.$section_infos['NAME']."</p>\n";
$entries = '';
/* Parse sub-plugins */
@@ -355,6 +354,7 @@ class pluglist {
$this->menu .= '<li><a>'.$section_infos['NAME']."</a>\n<ul>\n".$entries."\n</ul></li>\n";
}
}
+ $this->menu .= '</ul>'."\n";
}
/* Add the menucurrent class to current plugin */
@@ -427,7 +427,7 @@ class pluglist {
if (!preg_match("/\//", $plIcon) && !preg_match("/^geticon/", $plIcon)) {
$image = get_template_path("plugins/".preg_replace('%^.*/([^/]+)/[^/]+$%', '\1', $class_mapping[$info['CLASS']])."/images/$plIcon");
} else {
- $image = $plIcon;
+ $image = htmlentities($plIcon, ENT_COMPAT, 'UTF-8');
}
}
diff --git a/include/functions.inc b/include/functions.inc
index 123c962f8..fc96aee59 100644
--- a/include/functions.inc
+++ b/include/functions.inc
@@ -1773,15 +1773,15 @@ function check_command($cmdline)
*
* \return the $display variable
*/
-function print_header($image, $headline, $info = "")
+function print_header($image, $headline, $info = '')
{
$smarty = get_smarty();
- $smarty->assign("headline", $headline);
- $smarty->assign("headline_image", $image);
- $display = "";
+ $smarty->assign('headline', $headline);
+ $smarty->assign('headline_image', $image);
+ $display = '';
- if ($info != "") {
- $display .= "<div class=\"pluginfo\">\n";
+ if ($info != '') {
+ $display .= '<div class="pluginfo">'."\n";
$display .= "$info";
$display .= "</div>\n";
$display .= "<div></div>\n";
diff --git a/plugins/personal/generic/class_user.inc b/plugins/personal/generic/class_user.inc
index 322353725..0ceb2efd3 100644
--- a/plugins/personal/generic/class_user.inc
+++ b/plugins/personal/generic/class_user.inc
@@ -163,8 +163,8 @@ class user extends simplePlugin
return array(
'plShortName' => _('Generic'),
'plDescription' => _('Generic user settings'),
- 'plIcon' => 'geticon.php?context=applications&icon=user-info&size=48',
- 'plSmallIcon' => 'geticon.php?context=applications&icon=user-info&size=16',
+ 'plIcon' => 'geticon.php?context=applications&icon=user-info&size=48',
+ 'plSmallIcon' => 'geticon.php?context=applications&icon=user-info&size=16',
'plSelfModify' => TRUE,
'plObjectType' => array('user' => array(
'description' => _('Users'),
diff --git a/setup/setup_frame.tpl b/setup/setup_frame.tpl
index 5659e7796..57cc735ec 100644
--- a/setup/setup_frame.tpl
+++ b/setup/setup_frame.tpl
@@ -4,9 +4,9 @@
<form action="setup.php" name="mainform" id="mainform" method="post" enctype="multipart/form-data">
<div class="setup_header">
<div id="header_left">
- <img id="fd_logo" class="optional" src="geticon.php?context=applications&icon=fusiondirectory&size=48" alt="FusionDirectory"/>
+ <img id="fd_logo" class="optional" src="geticon.php?context=applications&icon=fusiondirectory&size=48" alt="FusionDirectory"/>
<a class="plugtop">
- <img src="{$headline_image}" alt="{t}{$headline}{/t}"/>{t}{$headline}{/t}
+ <img src="{$headline_image|escape}" alt="{t}{$headline}{/t}"/>{t}{$headline}{/t}
</a>
</div>
<div id="header_right">
--
GitLab