From 12dac1ce57a2ccffd63536829635f46d15455a23 Mon Sep 17 00:00:00 2001
From: xia0ta0 <xia0ta0@outlook.com>
Date: Mon, 24 Mar 2014 16:33:20 +0800
Subject: [PATCH]  * code for task#1835.

---
 module/bug/view/edit.html.php         | 2 +-
 module/build/view/edit.html.php       | 2 +-
 module/common/view/action.html.php    | 2 +-
 module/product/view/edit.html.php     | 2 +-
 module/productplan/view/edit.html.php | 2 +-
 module/project/view/edit.html.php     | 2 +-
 module/release/view/edit.html.php     | 3 +--
 module/story/view/change.html.php     | 4 ++--
 module/task/view/edit.html.php        | 6 +++---
 module/testtask/view/edit.html.php    | 2 +-
 10 files changed, 13 insertions(+), 14 deletions(-)

diff --git a/module/bug/view/edit.html.php b/module/bug/view/edit.html.php
index 619817bff3..6359ae05ed 100644
--- a/module/bug/view/edit.html.php
+++ b/module/bug/view/edit.html.php
@@ -44,7 +44,7 @@ js::set('oldResolvedBuild'       , $bug->resolvedBuild);
         <tr class='bd-none'><td class='bd-none'>
           <fieldset>
             <legend><?php echo $lang->bug->legendSteps;?></legend>
-           <?php echo html::textarea('steps', $bug->steps, "rows='12' class='area-1'");?>
+            <?php echo html::textarea('steps', htmlspecialchars($bug->steps), "rows='12' class='area-1'");?>
           </fieldset>
           <fieldset>
           <legend><?php echo $lang->bug->legendComment;?></legend>
diff --git a/module/build/view/edit.html.php b/module/build/view/edit.html.php
index f7bc359e24..7dbea1bd61 100644
--- a/module/build/view/edit.html.php
+++ b/module/build/view/edit.html.php
@@ -125,7 +125,7 @@
     </tr>
     <tr>
       <th class='rowhead'><?php echo $lang->build->desc;?></th>
-      <td><?php echo html::textarea('desc', $build->desc, "rows='10' class='area-1'");?></td>
+      <td><?php echo html::textarea('desc', htmlspecialchars($build->desc), "rows='10' class='area-1'");?></td>
     </tr>  
     <tr><td colspan='2' class='a-center'><?php echo html::submitButton() . html::backButton() .html::hidden('project', $build->project);?></td></tr>
   </table>
diff --git a/module/common/view/action.html.php b/module/common/view/action.html.php
index 0aa199b5b9..f1284a4e6a 100755
--- a/module/common/view/action.html.php
+++ b/module/common/view/action.html.php
@@ -152,7 +152,7 @@ $(function(){
         <div class='hidden' id='lastCommentBox'>
           <form method='post' action='<?php echo $this->createLink('action', 'editComment', "actionID=$action->id")?>'>
             <table align='center' class='table-1'>
-              <tr><td><?php echo html::textarea('lastComment', $action->comment,"rows='5' class='w-p100'");?></td></tr>
+              <tr><td><?php echo html::textarea('lastComment', htmlspecialchars($action->comment),"rows='5' class='w-p100'");?></td></tr>
               <tr><td><?php echo html::submitButton() . html::commonButton($lang->goback, "onclick='toggleComment($action->id)' class='button-b'");?></td></tr>
             </table>
           </form>
diff --git a/module/product/view/edit.html.php b/module/product/view/edit.html.php
index 49b02b39e6..24f9e079f7 100644
--- a/module/product/view/edit.html.php
+++ b/module/product/view/edit.html.php
@@ -41,7 +41,7 @@
     </tr>  
     <tr>
       <th class='rowhead'><?php echo $lang->product->desc;?></th>
-      <td><?php echo html::textarea('desc', $product->desc, "rows='8' class='area-1'");?></td>
+      <td><?php echo html::textarea('desc', htmlspecialchars($product->desc), "rows='8' class='area-1'");?></td>
     </tr>  
     <tr>
       <th class='rowhead'><?php echo $lang->product->acl;?></th>
diff --git a/module/productplan/view/edit.html.php b/module/productplan/view/edit.html.php
index acccc2e013..b3124a97e8 100644
--- a/module/productplan/view/edit.html.php
+++ b/module/productplan/view/edit.html.php
@@ -34,7 +34,7 @@
     </tr>  
     <tr>
       <th class='rowhead'><?php echo $lang->productplan->desc;?></th>
-      <td><?php echo html::textarea('desc', $plan->desc, "rows='10' class='area-1'");?></td>
+      <td><?php echo html::textarea('desc', htmlspecialchars($plan->desc), "rows='10' class='area-1'");?></td>
     </tr>  
     <tr>
       <td colspan='2' class='a-center'>
diff --git a/module/project/view/edit.html.php b/module/project/view/edit.html.php
index 5ba5bf70ad..a7f9ab8a58 100644
--- a/module/project/view/edit.html.php
+++ b/module/project/view/edit.html.php
@@ -71,7 +71,7 @@
     </tr>
     <tr>
       <th class='rowhead'><?php echo $lang->project->desc;?></th>
-      <td><?php echo html::textarea('desc', $project->desc, "rows='6' class='area-1'");?></td>
+      <td><?php echo html::textarea('desc', htmlspecialchars($project->desc), "rows='6' class='area-1'");?></td>
     </tr>  
     <tr>
       <th class='rowhead'><?php echo $lang->project->acl;?></th>
diff --git a/module/release/view/edit.html.php b/module/release/view/edit.html.php
index e6c83b28c0..cfc2042988 100644
--- a/module/release/view/edit.html.php
+++ b/module/release/view/edit.html.php
@@ -32,7 +32,6 @@
       <th class='rowhead'><?php echo $lang->release->linkStoriesAndBugs;?></th>
       <td>
         <div class="w-p90">
-
           <div class='half-left'>
             <table class='mainTable'>
               <tr style='border-bottom:none'>
@@ -106,7 +105,7 @@
     </tr>
     <tr>
       <th class='rowhead'><?php echo $lang->release->desc;?></th>
-      <td><?php echo html::textarea('desc', $release->desc, "rows=10 class='area-1'");?></td>
+      <td><?php echo html::textarea('desc', htmlspecialchars($release->desc), "rows=10 class='area-1'");?></td>
     </tr>  
     <tr>
       <th class='rowhead'><?php echo $lang->files;?></th>
diff --git a/module/story/view/change.html.php b/module/story/view/change.html.php
index b3431ccd95..e4719f4d3c 100644
--- a/module/story/view/change.html.php
+++ b/module/story/view/change.html.php
@@ -24,11 +24,11 @@
     </tr>
     <tr>
       <th class='rowhead'><?php echo $lang->story->spec;?></th>
-      <td><?php echo html::textarea('spec', $story->spec, 'rows=8 class="area-1"');?><br /> <?php echo $lang->story->specTemplate;?></td>
+      <td><?php echo html::textarea('spec', htmlspecialchars($story->spec), 'rows=8 class="area-1"');?><br /> <?php echo $lang->story->specTemplate;?></td>
     </tr>
     <tr>
       <th class='rowhead'><?php echo $lang->story->verify;?></th>
-      <td><?php echo html::textarea('verify', $story->verify, 'rows=6 class="area-1"');?></td>
+      <td><?php echo html::textarea('verify', htmlspecialchars($story->verify), 'rows=6 class="area-1"');?></td>
     </tr>
     <tr>
       <th class='rowhead'><?php echo $lang->story->comment;?></th>
diff --git a/module/task/view/edit.html.php b/module/task/view/edit.html.php
index ffb4c6a78b..eb02839a26 100644
--- a/module/task/view/edit.html.php
+++ b/module/task/view/edit.html.php
@@ -30,7 +30,7 @@
         <tr class='bd-none'><td class='bd-none'>
           <fieldset>
             <legend><?php echo $lang->task->desc;?></legend>
-            <?php echo html::textarea('desc', $task->desc, "rows='8' class='area-1'");?>
+            <?php echo html::textarea('desc', htmlspecialchars($task->desc), "rows='8' class='area-1'");?>
           </fieldset>
           <fieldset>
             <legend><?php echo $lang->comment;?></legend>
@@ -49,11 +49,11 @@
     <td class='side'>
       <fieldset>
         <legend><?php echo $lang->task->legendBasic;?></legend>
-        <table class='table-1'> 
+        <table class='table-1'>
           <tr>
             <th class='rowhead w-p20'><?php echo $lang->task->project;?></th>
             <td><?php echo html::select('project', $projects, $task->project, 'class="select-1" onchange="loadAll(this.value)"');?></td>
-          </tr>  
+          </tr>
           <tr>
             <th class='rowhead w-p20'><?php echo $lang->task->module;?></th>
             <td><span id="moduleIdBox"><?php echo html::select('module', $modules, $task->module, 'class="select-1"');?></span></td>
diff --git a/module/testtask/view/edit.html.php b/module/testtask/view/edit.html.php
index 08708c53ba..c94c9e0e07 100644
--- a/module/testtask/view/edit.html.php
+++ b/module/testtask/view/edit.html.php
@@ -50,7 +50,7 @@
     </tr>  
     <tr>
       <th class='rowhead'><?php echo $lang->testtask->desc;?></th>
-      <td><?php echo html::textarea('desc', $task->desc, "rows=10 class='area-1'");?></td>
+      <td><?php echo html::textarea('desc', htmlspecialchars($task->desc), "rows=10 class='area-1'");?></td>
     </tr>  
     <tr>
       <th class='rowhead'><?php echo $lang->testtask->report;?></th>