* code for task#1835.

2014-03-24 16:33:20 +08:00
parent 689c758bdb
commit 12dac1ce57
10 changed files with 13 additions and 14 deletions
@@ -44,7 +44,7 @@ js::set('oldResolvedBuild'       , $bug->resolvedBuild);
        <tr class='bd-none'><td class='bd-none'>
          <fieldset>
            <legend><?php echo $lang->bug->legendSteps;?></legend>
-           <?php echo html::textarea('steps', $bug->steps, "rows='12' class='area-1'");?>
+            <?php echo html::textarea('steps', htmlspecialchars($bug->steps), "rows='12' class='area-1'");?>
          </fieldset>
          <fieldset>
          <legend><?php echo $lang->bug->legendComment;?></legend>
@@ -125,7 +125,7 @@
    </tr>
    <tr>
      <th class='rowhead'><?php echo $lang->build->desc;?></th>
-      <td><?php echo html::textarea('desc', $build->desc, "rows='10' class='area-1'");?></td>
+      <td><?php echo html::textarea('desc', htmlspecialchars($build->desc), "rows='10' class='area-1'");?></td>
    </tr>  
    <tr><td colspan='2' class='a-center'><?php echo html::submitButton() . html::backButton() .html::hidden('project', $build->project);?></td></tr>
  </table>
@@ -152,7 +152,7 @@ $(function(){
        <div class='hidden' id='lastCommentBox'>
          <form method='post' action='<?php echo $this->createLink('action', 'editComment', "actionID=$action->id")?>'>
            <table align='center' class='table-1'>
-              <tr><td><?php echo html::textarea('lastComment', $action->comment,"rows='5' class='w-p100'");?></td></tr>
+              <tr><td><?php echo html::textarea('lastComment', htmlspecialchars($action->comment),"rows='5' class='w-p100'");?></td></tr>
              <tr><td><?php echo html::submitButton() . html::commonButton($lang->goback, "onclick='toggleComment($action->id)' class='button-b'");?></td></tr>
            </table>
          </form>
@@ -41,7 +41,7 @@
    </tr>  
    <tr>
      <th class='rowhead'><?php echo $lang->product->desc;?></th>
-      <td><?php echo html::textarea('desc', $product->desc, "rows='8' class='area-1'");?></td>
+      <td><?php echo html::textarea('desc', htmlspecialchars($product->desc), "rows='8' class='area-1'");?></td>
    </tr>  
    <tr>
      <th class='rowhead'><?php echo $lang->product->acl;?></th>
@@ -34,7 +34,7 @@
    </tr>  
    <tr>
      <th class='rowhead'><?php echo $lang->productplan->desc;?></th>
-      <td><?php echo html::textarea('desc', $plan->desc, "rows='10' class='area-1'");?></td>
+      <td><?php echo html::textarea('desc', htmlspecialchars($plan->desc), "rows='10' class='area-1'");?></td>
    </tr>  
    <tr>
      <td colspan='2' class='a-center'>
@@ -71,7 +71,7 @@
    </tr>
    <tr>
      <th class='rowhead'><?php echo $lang->project->desc;?></th>
-      <td><?php echo html::textarea('desc', $project->desc, "rows='6' class='area-1'");?></td>
+      <td><?php echo html::textarea('desc', htmlspecialchars($project->desc), "rows='6' class='area-1'");?></td>
    </tr>  
    <tr>
      <th class='rowhead'><?php echo $lang->project->acl;?></th>
@@ -32,7 +32,6 @@
      <th class='rowhead'><?php echo $lang->release->linkStoriesAndBugs;?></th>
      <td>
        <div class="w-p90">
-
          <div class='half-left'>
            <table class='mainTable'>
              <tr style='border-bottom:none'>
@@ -106,7 +105,7 @@
    </tr>
    <tr>
      <th class='rowhead'><?php echo $lang->release->desc;?></th>
-      <td><?php echo html::textarea('desc', $release->desc, "rows=10 class='area-1'");?></td>
+      <td><?php echo html::textarea('desc', htmlspecialchars($release->desc), "rows=10 class='area-1'");?></td>
    </tr>  
    <tr>
      <th class='rowhead'><?php echo $lang->files;?></th>
@@ -24,11 +24,11 @@
    </tr>
    <tr>
      <th class='rowhead'><?php echo $lang->story->spec;?></th>
-      <td><?php echo html::textarea('spec', $story->spec, 'rows=8 class="area-1"');?><br /> <?php echo $lang->story->specTemplate;?></td>
+      <td><?php echo html::textarea('spec', htmlspecialchars($story->spec), 'rows=8 class="area-1"');?><br /> <?php echo $lang->story->specTemplate;?></td>
    </tr>
    <tr>
      <th class='rowhead'><?php echo $lang->story->verify;?></th>
-      <td><?php echo html::textarea('verify', $story->verify, 'rows=6 class="area-1"');?></td>
+      <td><?php echo html::textarea('verify', htmlspecialchars($story->verify), 'rows=6 class="area-1"');?></td>
    </tr>
    <tr>
      <th class='rowhead'><?php echo $lang->story->comment;?></th>
@@ -30,7 +30,7 @@
        <tr class='bd-none'><td class='bd-none'>
          <fieldset>
            <legend><?php echo $lang->task->desc;?></legend>
-            <?php echo html::textarea('desc', $task->desc, "rows='8' class='area-1'");?>
+            <?php echo html::textarea('desc', htmlspecialchars($task->desc), "rows='8' class='area-1'");?>
          </fieldset>
          <fieldset>
            <legend><?php echo $lang->comment;?></legend>
@@ -49,11 +49,11 @@
    <td class='side'>
      <fieldset>
        <legend><?php echo $lang->task->legendBasic;?></legend>
-        <table class='table-1'> 
+        <table class='table-1'>
          <tr>
            <th class='rowhead w-p20'><?php echo $lang->task->project;?></th>
            <td><?php echo html::select('project', $projects, $task->project, 'class="select-1" onchange="loadAll(this.value)"');?></td>
-          </tr>  
+          </tr>
          <tr>
            <th class='rowhead w-p20'><?php echo $lang->task->module;?></th>
            <td><span id="moduleIdBox"><?php echo html::select('module', $modules, $task->module, 'class="select-1"');?></span></td>
@@ -50,7 +50,7 @@
    </tr>  
    <tr>
      <th class='rowhead'><?php echo $lang->testtask->desc;?></th>
-      <td><?php echo html::textarea('desc', $task->desc, "rows=10 class='area-1'");?></td>
+      <td><?php echo html::textarea('desc', htmlspecialchars($task->desc), "rows=10 class='area-1'");?></td>
    </tr>  
    <tr>
      <th class='rowhead'><?php echo $lang->testtask->report;?></th>