Changeset 2576:93f2aabd0607 for plugins/simpleMenu

Timestamp:

11/21/13 11:02:04 (12 years ago)

Author:

franck <carnet.franck.paul@…>

Branch:

2.6

Message:

Escape label and description fields in simpleMenu, fixes #1878

Location:

plugins/simpleMenu

Files:

• _define.php (modified) (1 diff)
• _public.php (modified) (1 diff)
• index.php (modified) (1 diff)

plugins/simpleMenu/_define.php

@@ -16 +16 @@
      /* Description*/         "Simple menu for Dotclear",
      /* Author */             "Franck Paul",
-     /* Version */            '1.1.1',
+     /* Version */            '1.1.2',
      array(
           'permissions' =>    'admin',

plugins/simpleMenu/_public.php

@@ -96 +96 @@
                     if ($m['descr']) {
                          if ($description == 'title') {
-                              $title = ' title="'.__($m['descr']).'"';
+                              $title = ' title="'.html::escapeHTML(__($m['descr'])).'"';
                          } else {
-                              $span = ' <span>'.__($m['descr']).'</span>';
+                              $span = ' <span>'.html::escapeHTML(__($m['descr'])).'</span>';
                          }
                     }
+                    $label = html::escapeHTML(__($m['label']));
 
                     $item = new ArrayObject(array(
                          'url' => $href,                         // URL
-                         'label' => __($m['label']),        // <a> link label
+                         'label' => $label,                 // <a> link label
                          'title' => $title,                 // <a> link title (optional)
                          'span' => $span,                   // description (will be displayed after <a> link)

plugins/simpleMenu/index.php

@@ -497 +497 @@
           if (!$step) {
                $count++;
-               echo '<td class="handle minimal">'.form::field(array('order['.$i.']'),2,3,$count,'position','',false,'title="'.sprintf(__('position of %s'),__($m['label'])).'"').
+               echo '<td class="handle minimal">'.
+                    form::field(array('order['.$i.']'),2,3,$count,'position','',false,'title="'.sprintf(__('position of %s'),html::escapeHTML(__($m['label']))).'"').
                     form::hidden(array('dynorder[]','dynorder-'.$i),$i).'</td>';
                echo '<td class="minimal">'.form::checkbox(array('items_selected[]','ims-'.$i),$i).'</td>';
-               echo '<td class="nowrap" scope="row">'.form::field(array('items_label[]','iml-'.$i),'',255,__($m['label'])).'</td>';
-               echo '<td class="nowrap">'.form::field(array('items_descr[]','imd-'.$i),'30',255,__($m['descr'])).'</td>';
-               echo '<td class="nowrap">'.form::field(array('items_url[]','imu-'.$i),'30',255,$m['url']).'</td>';
+               echo '<td class="nowrap" scope="row">'.form::field(array('items_label[]','iml-'.$i),'',255,html::escapeHTML(__($m['label']))).'</td>';
+               echo '<td class="nowrap">'.form::field(array('items_descr[]','imd-'.$i),'30',255,html::escapeHTML(__($m['descr']))).'</td>';
+               echo '<td class="nowrap">'.form::field(array('items_url[]','imu-'.$i),'30',255,html::escapeHTML($m['url'])).'</td>';
           } else {
-               echo '<td class="nowrap" scope="row">'.__($m['label']).'</td>';
-               echo '<td class="nowrap">'.__($m['descr']).'</td>';
-               echo '<td class="nowrap">'.$m['url'].'</td>';
+               echo '<td class="nowrap" scope="row">'.html::escapeHTML(__($m['label'])).'</td>';
+               echo '<td class="nowrap">'.html::escapeHTML(__($m['descr'])).'</td>';
+               echo '<td class="nowrap">'.html::escapeHTML($m['url']).'</td>';
           }
           echo '</tr>';