From 2b68b8876e92c687b88dc71b51135f62f2b21900 Mon Sep 17 00:00:00 2001 From: Ivan Tcholakov Date: Sat, 16 May 2009 09:28:22 +0200 Subject: [PATCH] [svn r20716] FS#306 - Replacing some natural language unsafe occurrences of the function htmlentities() and other similar fixes. --- main/chat/chat_chat.php | 6 +++--- main/exercice/exercice.php | 4 ++-- main/exercice/hotspot_admin.inc.php | 4 ++-- main/exercice/question_list_admin.inc.php | 8 ++++---- main/forum/viewthread_flat.inc.php | 2 +- main/forum/viewthread_nested.inc.php | 2 +- main/forum/viewthread_threaded.inc.php | 2 +- main/link/link.php | 12 ++++++------ main/messages/message.class.php | 6 +++--- main/reservation/m_category.php | 4 ++-- main/reservation/m_item.php | 4 ++-- main/reservation/m_item_origineel.php | 4 ++-- main/reservation/m_reservation.php | 2 +- main/reservation/mysubscriptions.php | 4 ++-- main/work/work.lib.php | 6 +++--- whoisonline.php | 6 +++--- 16 files changed, 38 insertions(+), 38 deletions(-) diff --git a/main/chat/chat_chat.php b/main/chat/chat_chat.php index 755fceaf84..49d9aad988 100755 --- a/main/chat/chat_chat.php +++ b/main/chat/chat_chat.php @@ -134,7 +134,7 @@ if (!empty($course)) echo '
'; foreach($content as $thisLine) { - echo strip_tags(html_entity_decode($thisLine),'
'); + echo strip_tags(api_html_entity_decode($thisLine),'
'); } echo '
'; @@ -147,7 +147,7 @@ if (!empty($course)) { $rand=mt_rand(1,1000); echo ''; } } @@ -158,4 +158,4 @@ else Display :: display_error_message($message); } include('footer_frame.inc.php'); -?> \ No newline at end of file +?> diff --git a/main/exercice/exercice.php b/main/exercice/exercice.php index 235255e5d1..90c48ea90d 100644 --- a/main/exercice/exercice.php +++ b/main/exercice/exercice.php @@ -1,5 +1,5 @@ - ')) return false;"> <?php echo htmlentities(get_lang('Delete'),ENT_QUOTES,$charset); ?> + ')) return false;"> <?php echo api_htmlentities(get_lang('Delete'),ENT_QUOTES,$charset); ?> - + - + selectLevel(); ?> <?php echo get_lang('Modify'); ?> <?php echo get_lang('Delete'); ?> + itQuestion="><?php echo get_lang('Modify'); ?> <?php echo get_lang('Delete'); ?> <?php echo get_lang('MoveUp'); ?> @@ -151,4 +151,4 @@ if(!$i) { } ?> - \ No newline at end of file + diff --git a/main/forum/viewthread_flat.inc.php b/main/forum/viewthread_flat.inc.php index 11430d0d04..9b3fd9d916 100644 --- a/main/forum/viewthread_flat.inc.php +++ b/main/forum/viewthread_flat.inc.php @@ -148,7 +148,7 @@ foreach ($rows as $row) { echo ' "> '.$user_filename.' '; echo ''.$attachment_list['comment'].''; if (($current_forum['allow_edit']==1 AND $row['user_id']==$_user['user_id']) or (api_is_allowed_to_edit(false,true) && !(api_is_course_coach() && $current_forum['session_id']!=$_SESSION['id_session']))) { - echo '  '.Display::return_icon('delete.gif',get_lang('Delete')).'
'; + echo '  '.Display::return_icon('delete.gif',get_lang('Delete')).'
'; } echo ''; } diff --git a/main/forum/viewthread_nested.inc.php b/main/forum/viewthread_nested.inc.php index 0b785c14ee..d6ab650863 100644 --- a/main/forum/viewthread_nested.inc.php +++ b/main/forum/viewthread_nested.inc.php @@ -148,7 +148,7 @@ foreach ($rows as $post) { echo ' "> '.$user_filename.' '; echo ''.$attachment_list['comment'].''; if (($current_forum['allow_edit']==1 AND $post['user_id']==$_user['user_id']) or (api_is_allowed_to_edit(false,true) && !(api_is_course_coach() && $current_forum['session_id']!=$_SESSION['id_session']))) { - echo '  '.Display::return_icon('delete.gif',get_lang('Delete')).'
'; + echo '  '.Display::return_icon('delete.gif',get_lang('Delete')).'
'; } echo ''; } diff --git a/main/forum/viewthread_threaded.inc.php b/main/forum/viewthread_threaded.inc.php index 38e6889a31..e9713784fd 100644 --- a/main/forum/viewthread_threaded.inc.php +++ b/main/forum/viewthread_threaded.inc.php @@ -343,7 +343,7 @@ if (!empty($attachment_list)) echo ' "> '.$user_filename.' '; echo ''.$attachment_list['comment'].''; if (($current_forum['allow_edit']==1 AND $rows[$display_post_id]['user_id']==$_user['user_id']) or (api_is_allowed_to_edit(false,true) && !(api_is_course_coach() && $current_forum['session_id']!=$_SESSION['id_session']))) { - echo '  '.Display::return_icon('delete.gif',get_lang('Delete')).'
'; + echo '  '.Display::return_icon('delete.gif',get_lang('Delete')).'
'; } echo ''; } diff --git a/main/link/link.php b/main/link/link.php index 7281be4e2e..da88afd455 100644 --- a/main/link/link.php +++ b/main/link/link.php @@ -1,4 +1,4 @@ -* '.get_lang('CategoryName').'
- +
'; @@ -350,7 +350,7 @@ if (is_allowed_to_edit() and isset($_GET['action'])) { '.get_lang('Description').'
- +
'; @@ -407,13 +407,13 @@ if (empty($_GET['action']) || ($_GET['action']!='editlink' && $_GET['action']!=' for($j = 1; $j <= $aantalcategories; $j++) { echo "0"; } - echo "\">$shownone"; + echo "\">".get_lang('shownone').""; echo Display::return_icon('add.gif', $showall)." $showall"; + echo "\">".get_lang('showall').""; } echo ''; @@ -463,7 +463,7 @@ if (empty($_GET['action']) || ($_GET['action']!='editlink' && $_GET['action']!=' echo ''; echo ''; echo '"; - echo "  ".htmlentities($myrow["category_title"],ENT_QUOTES,$charset)."
   ".$myrow["description"]; + echo "  ".api_htmlentities($myrow["category_title"],ENT_QUOTES,$charset)."
   ".$myrow["description"]; if (is_allowed_to_edit()) { diff --git a/main/messages/message.class.php b/main/messages/message.class.php index a0e1e6d5f9..b13f3f4cf4 100755 --- a/main/messages/message.class.php +++ b/main/messages/message.class.php @@ -181,8 +181,8 @@ class MessageManager { public static function send_message ($receiver_user_id, $title, $content) { global $charset; $table_message = Database::get_main_table(TABLE_MESSAGE); - $title = mb_convert_encoding($title,$charset,'UTF-8'); - $content = mb_convert_encoding($content,$charset,'UTF-8'); + $title = api_convert_encoding($title,$charset,'UTF-8'); + $content = api_convert_encoding($content,$charset,'UTF-8'); //message in inbox $sql = "SELECT COUNT(*) as count FROM $table_message WHERE user_sender_id = ".api_get_user_id()." AND user_receiver_id='".Database::escape_string($receiver_user_id)."' AND title = '".Database::escape_string($title)."' AND content ='".Database::escape_string($content)."' "; $res_exist = api_sql_query($sql,__FILE__,__LINE__); @@ -300,7 +300,7 @@ class MessageManager { $message[2] = ''.GetFullUserName($result[4]).''; $message[3] = ''.$result[2].''; $message[5] = ''.Display::return_icon('message_reply.png',get_lang('ReplyToMessage')).''. - '  '.Display::return_icon('message_delete.png',get_lang('DeleteMessage')).''; + '  '.Display::return_icon('message_delete.png',get_lang('DeleteMessage')).''; } $message[4] = $result[3]; //date stays the same foreach($message as $key => $value) { diff --git a/main/reservation/m_category.php b/main/reservation/m_category.php index 46241a09f2..ebd13599f2 100644 --- a/main/reservation/m_category.php +++ b/main/reservation/m_category.php @@ -51,7 +51,7 @@ $interbreadcrumb[] = array ("url" => "../admin/index.php", "name" => get_lang('P * @param - int $id The ResourceType-id */ function modify_filter($id) { - return ''.' '; + return ''.' '; } /** @@ -146,4 +146,4 @@ switch ($_GET['action']) { */ Display :: display_footer(); -?> \ No newline at end of file +?> diff --git a/main/reservation/m_item.php b/main/reservation/m_item.php index 68af7352cd..b1a406c95b 100644 --- a/main/reservation/m_item.php +++ b/main/reservation/m_item.php @@ -59,7 +59,7 @@ function modify_filter($id) { $str.=''; } //if(Rsys::item_allow($id,'m_rights')) $str.='  '; - if(Rsys::item_allow($id,'delete')) $str.=' '; + if(Rsys::item_allow($id,'delete')) $str.=' '; return $str; } @@ -70,7 +70,7 @@ function modify_filter($id) { * @param - int $id The item-rights-id's */ function modify_rights_filter($id) { - return ' '; + return ' '; } /** diff --git a/main/reservation/m_item_origineel.php b/main/reservation/m_item_origineel.php index 39e996434d..3aa412ff95 100644 --- a/main/reservation/m_item_origineel.php +++ b/main/reservation/m_item_origineel.php @@ -50,7 +50,7 @@ function modify_filter($id) { $str.=''; } if(Rsys::item_allow($id,'m_rights')) $str.='  '; - if(Rsys::item_allow($id,'delete')) $str.=' '; + if(Rsys::item_allow($id,'delete')) $str.=' '; if(Rsys::item_allow($id,'edit')){ $number = Rsys :: get_item($id); $str.= ' '; @@ -430,4 +430,4 @@ switch ($_GET['action']) { */ Display :: display_footer(); -?> \ No newline at end of file +?> diff --git a/main/reservation/m_reservation.php b/main/reservation/m_reservation.php index c0bd61d29e..dbd0b465e6 100644 --- a/main/reservation/m_reservation.php +++ b/main/reservation/m_reservation.php @@ -45,7 +45,7 @@ $tool_name = get_lang('BookingPeriodList'); function modify_filter($id) { $out = ' '.get_lang('AutoAccept').''; $out .= ''.get_lang('EditBookingPeriod').''; - $out .= ' '.get_lang('DeleteBookingPeriod').''; + $out .= ' '.get_lang('DeleteBookingPeriod').''; return $out; } diff --git a/main/reservation/mysubscriptions.php b/main/reservation/mysubscriptions.php index af8f582efb..4ddd5b156f 100644 --- a/main/reservation/mysubscriptions.php +++ b/main/reservation/mysubscriptions.php @@ -44,7 +44,7 @@ $tool_name = get_lang('Booking'); * Filter to display the modify-buttons */ function modify_filter($id){ - return ' '; + return ' '; } /** @@ -105,4 +105,4 @@ switch ($_GET['action']) { */ Display :: display_footer(); -?> \ No newline at end of file +?> diff --git a/main/work/work.lib.php b/main/work/work.lib.php index d6af4b2906..a28825c0ea 100644 --- a/main/work/work.lib.php +++ b/main/work/work.lib.php @@ -1,4 +1,4 @@ -, Ghent University - ability for course admins to specify wether uploaded documents are visible or invisible by default. * @author Roan Embrechts, code refactoring and virtual course support * @author Frederic Vauthier, directories management -* @version $Id: work.lib.php 20709 2009-05-15 19:12:37Z ivantcholakov $ +* @version $Id: work.lib.php 20716 2009-05-16 07:28:22Z ivantcholakov $ */ /** * Displays action links (for admins, authorized groups members and authorized students) @@ -52,7 +52,7 @@ function display_action_links($cur_dir_path, $always_show_tool_options, $always_ { // delete all files $display_output .= "". + "onclick=\"javascript:if(!confirm('".addslashes(api_htmlentities(get_lang('ConfirmYourChoice'),ENT_QUOTES,$charset))."')) return false;\">". Display::return_icon('delete.gif', get_lang('Delete')).' '.get_lang('DeleteAllFiles').""; // make all files visible or invisible diff --git a/whoisonline.php b/whoisonline.php index 923bdaa7a2..581a91ab63 100644 --- a/whoisonline.php +++ b/whoisonline.php @@ -1,4 +1,4 @@ -'; if (isset($_GET['id'])) { echo ''.get_lang('Back').''; @@ -397,4 +397,4 @@ echo ''; */ /*echo '';*/ Display::display_footer(); -?> \ No newline at end of file +?>