diff --git a/framework/base/helper.class.php b/framework/base/helper.class.php index ec1acf2e2c..1a2889abce 100644 --- a/framework/base/helper.class.php +++ b/framework/base/helper.class.php @@ -882,3 +882,17 @@ function isHttps() if(!empty($_SERVER['HTTP_FRONT_END_HTTPS']) && strtolower($_SERVER['HTTP_FRONT_END_HTTPS']) !== 'off') return true; return false; } + +/** + * Compatibility for htmlspecialchars. + * + * @param string $string + * @param int $flags + * @param string $encoding + * @access public + * @return string + */ +function htmlSpecialString($string, $flags = ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401, $encoding = 'UTF-8') +{ + return htmlspecialchars($string, $flags, $encoding); +} diff --git a/framework/base/router.class.php b/framework/base/router.class.php index 4f8b3885c5..f0db46e652 100644 --- a/framework/base/router.class.php +++ b/framework/base/router.class.php @@ -2288,7 +2288,7 @@ class baseRouter public function triggerError($message, $file, $line, $exit = false) { /* 设置错误信息(Set the error info) */ - $message = htmlspecialchars($message); + $message = htmlSpecialString($message); if(preg_match('/[^\x00-\x80]/', $message)) $message = helper::convertEncoding($message, 'gbk'); /* Only show error when debug is open. */ diff --git a/lib/api/api.class.php b/lib/api/api.class.php index f5e1b00550..9eed7f471e 100755 --- a/lib/api/api.class.php +++ b/lib/api/api.class.php @@ -17,8 +17,8 @@ class ztclient public $session; /** - * The construce function. - * + * The construce function. + * * @param string $zentaoRoot the zentao root url * @param string $account the login account * @param string $password the passwod @@ -43,8 +43,8 @@ class ztclient } /** - * Get the settings through getconfig api from remote. - * + * Get the settings through getconfig api from remote. + * * @access private * @return object */ @@ -58,7 +58,7 @@ class ztclient /** * Set the session api. - * + * * @access private * @return string the session api url. */ @@ -69,7 +69,7 @@ class ztclient /** * Set the login api. - * + * * @access private * @return string the login api url. */ @@ -80,8 +80,8 @@ class ztclient /** * Set the method api. - * - * @param string $module the module name + * + * @param string $module the module name * @param string $method the methhod name * @param string $vars the vars to passwd * @access private @@ -110,8 +110,8 @@ class ztclient /** * Set the method api. - * - * @param string $module the module name + * + * @param string $module the module name * @param string $method the methhod name * @param string $vars the vars to passed * @access private @@ -138,8 +138,8 @@ class ztclient } /** - * Start session - * + * Start session + * * @access public * @return void */ @@ -151,7 +151,7 @@ class ztclient /** * Login. - * + * * @access public * @return void */ @@ -164,9 +164,9 @@ class ztclient } /** - * Fetch one method of a module's control. - * - * @param string $module the module name + * Fetch one method of a module's control. + * + * @param string $module the module name * @param string $method the methhod name * @param string $vars the vars to passwd * @access public @@ -178,9 +178,9 @@ class ztclient } /** - * Fetch one method of a module's model. - * - * @param string $module the module name + * Fetch one method of a module's model. + * + * @param string $module the module name * @param string $method the methhod name * @param string $vars the vars to passwd * @access public @@ -192,9 +192,9 @@ class ztclient } /** - * Get a api and check it. - * - * @param string $url + * Get a api and check it. + * + * @param string $url * @access private * @return bool */ @@ -209,9 +209,9 @@ class ztclient } /** - * Fetch one method of a module's control. - * - * @param string $module the module name + * Fetch one method of a module's control. + * + * @param string $module the module name * @param string $method the methhod name * @param array $vars the vars to passwd * @access public @@ -224,8 +224,8 @@ class ztclient /** * Post. - * - * @param string $url + * + * @param string $url * @access private * @return bool */ @@ -241,8 +241,8 @@ class ztclient /** * Append session param to the url. - * - * @param string $url + * + * @param string $url * @access private * @return string */ @@ -288,7 +288,7 @@ http://snoopy.sourceforge.net/ class Snoopy { /**** Public variables ****/ - + /* user definable vars */ var $host = "www.php.net"; // host name we are connecting to @@ -297,7 +297,7 @@ class Snoopy var $proxy_port = ""; // proxy port to use var $proxy_user = ""; // proxy user to use var $proxy_pass = ""; // proxy password to use - + var $agent = "Snoopy v1.2.4"; // agent we masquerade as var $referer = ""; // referer info to pass var $cookies = array(); // array of cookies to pass @@ -315,15 +315,15 @@ class Snoopy var $passcookies = true; // pass set cookies back through redirects // NOTE: this currently does not respect // dates, domains or paths. - + var $user = ""; // user for http authentication var $pass = ""; // password for http authentication - + // http accept types var $accept = "image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*"; - + var $results = ""; // where the content is put - + var $error = ""; // error messages sent here var $response_code = ""; // response code returned from server var $headers = array(); // headers returned from server sent here @@ -349,11 +349,11 @@ class Snoopy // library functions built into php, // as these functions are not stable // as of this Snoopy release. - - /**** Private variables ****/ - + + /**** Private variables ****/ + var $_maxlinelen = 4096; // max line length (headers) - + var $_httpmethod = "GET"; // default http request method var $_httpversion = "HTTP/1.0"; // default http request version var $_submit_method = "POST"; // default submit method @@ -363,7 +363,7 @@ class Snoopy var $_redirectdepth = 0; // increments on an http redirect var $_frameurls = array(); // frame src urls var $_framedepth = 0; // increments on frame depth - + var $_isproxy = false; // set if using a proxy server var $_fp_timeout = 30; // timeout for socket connection @@ -378,7 +378,7 @@ class Snoopy function fetch($URI) { - + //preg_match("|^([^:]+)://([^:/]+)(:[\d]+)*(.*)|",$URI,$URI_PARTS); $URI_PARTS = parse_url($URI); if (!empty($URI_PARTS["user"])) @@ -389,7 +389,7 @@ class Snoopy $URI_PARTS["query"] = ''; if (empty($URI_PARTS["path"])) $URI_PARTS["path"] = ''; - + switch(strtolower($URI_PARTS["scheme"])) { case "http": @@ -409,7 +409,7 @@ class Snoopy // no proxy, send only the path $this->_httprequest($path, $fp, $URI, $this->_httpmethod); } - + $this->_disconnect($fp); if($this->_redirectaddr) @@ -432,8 +432,8 @@ class Snoopy { $frameurls = $this->_frameurls; $this->_frameurls = array(); - - while(list(,$frameurl) = each($frameurls)) + + foreach($frameurls as $frameurl)) { if($this->_framedepth < $this->maxframes) { @@ -441,15 +441,17 @@ class Snoopy $this->_framedepth++; } else + { break; + } } - } + } } else { return false; } - return true; + return true; break; case "https": if(!$this->curl_path) @@ -503,15 +505,15 @@ class Snoopy else break; } - } - return true; + } + return true; break; default: // not a valid protocol $this->error = 'Invalid protocol "'.$URI_PARTS["scheme"].'"\n'; return false; break; - } + } return true; } @@ -529,9 +531,9 @@ class Snoopy function submit($URI, $formvars="", $formfiles="") { unset($postdata); - + $postdata = $this->_prepare_post_body($formvars, $formfiles); - + $URI_PARTS = parse_url($URI); if (!empty($URI_PARTS["user"])) $this->user = $URI_PARTS["user"]; @@ -561,17 +563,17 @@ class Snoopy // no proxy, send only the path $this->_httprequest($path, $fp, $URI, $this->_submit_method, $this->_submit_type, $postdata); } - + $this->_disconnect($fp); if($this->_redirectaddr) { /* url was redirected, check if we've hit the max depth */ if($this->maxredirs > $this->_redirectdepth) - { + { if(!preg_match("|^".$URI_PARTS["scheme"]."://|", $this->_redirectaddr)) - $this->_redirectaddr = $this->_expandlinks($this->_redirectaddr,$URI_PARTS["scheme"]."://".$URI_PARTS["host"]); - + $this->_redirectaddr = $this->_expandlinks($this->_redirectaddr,$URI_PARTS["scheme"]."://".$URI_PARTS["host"]); + // only follow redirect if it's on this site, or offsiteok is true if(preg_match("|^http://".preg_quote($this->host)."|i",$this->_redirectaddr) || $this->offsiteok) { @@ -590,9 +592,9 @@ class Snoopy { $frameurls = $this->_frameurls; $this->_frameurls = array(); - + while(list(,$frameurl) = each($frameurls)) - { + { if($this->_framedepth < $this->maxframes) { $this->fetch($frameurl); @@ -601,14 +603,14 @@ class Snoopy else break; } - } - + } + } else { return false; } - return true; + return true; break; case "https": if(!$this->curl_path) @@ -635,9 +637,9 @@ class Snoopy { /* url was redirected, check if we've hit the max depth */ if($this->maxredirs > $this->_redirectdepth) - { + { if(!preg_match("|^".$URI_PARTS["scheme"]."://|", $this->_redirectaddr)) - $this->_redirectaddr = $this->_expandlinks($this->_redirectaddr,$URI_PARTS["scheme"]."://".$URI_PARTS["host"]); + $this->_redirectaddr = $this->_expandlinks($this->_redirectaddr,$URI_PARTS["scheme"]."://".$URI_PARTS["host"]); // only follow redirect if it's on this site, or offsiteok is true if(preg_match("|^http://".preg_quote($this->host)."|i",$this->_redirectaddr) || $this->offsiteok) @@ -659,7 +661,7 @@ class Snoopy $this->_frameurls = array(); while(list(,$frameurl) = each($frameurls)) - { + { if($this->_framedepth < $this->maxframes) { $this->fetch($frameurl); @@ -668,16 +670,16 @@ class Snoopy else break; } - } - return true; + } + return true; break; - + default: // not a valid protocol $this->error = 'Invalid protocol "'.$URI_PARTS["scheme"].'"\n'; return false; break; - } + } return true; } @@ -691,7 +693,7 @@ class Snoopy function fetchlinks($URI) { if ($this->fetch($URI)) - { + { if($this->lastredirectaddr) $URI = $this->lastredirectaddr; if(is_array($this->results)) @@ -719,9 +721,9 @@ class Snoopy function fetchform($URI) { - + if ($this->fetch($URI)) - { + { if(is_array($this->results)) { @@ -730,14 +732,14 @@ class Snoopy } else $this->results = $this->_stripform($this->results); - + return true; } else return false; } - - + + /*======================================================================*\ Function: fetchtext Purpose: fetch the text from a web page, stripping the links @@ -748,7 +750,7 @@ class Snoopy function fetchtext($URI) { if($this->fetch($URI)) - { + { if(is_array($this->results)) { for($x=0;$xresults);$x++) @@ -772,7 +774,7 @@ class Snoopy function submitlinks($URI, $formvars="", $formfiles="") { if($this->submit($URI,$formvars, $formfiles)) - { + { if($this->lastredirectaddr) $URI = $this->lastredirectaddr; if(is_array($this->results)) @@ -806,7 +808,7 @@ class Snoopy function submittext($URI, $formvars = "", $formfiles = "") { if($this->submit($URI,$formvars, $formfiles)) - { + { if($this->lastredirectaddr) $URI = $this->lastredirectaddr; if(is_array($this->results)) @@ -830,7 +832,7 @@ class Snoopy return false; } - + /*======================================================================*\ Function: set_submit_multipart @@ -842,7 +844,7 @@ class Snoopy $this->_submit_type = "multipart/form-data"; } - + /*======================================================================*\ Function: set_submit_normal Purpose: Set the form submission content type to @@ -853,14 +855,14 @@ class Snoopy $this->_submit_type = "application/x-www-form-urlencoded"; } - - + + /*======================================================================*\ Private functions \*======================================================================*/ - - + + /*======================================================================*\ Function: _striplinks Purpose: strip the hyperlinks from an html document @@ -869,13 +871,13 @@ class Snoopy \*======================================================================*/ function _striplinks($document) - { + { preg_match_all("'<\s*a\s.*?href\s*=\s* # find ]+)) # if quote found, match up to next matching # quote, otherwise match up to next space 'isx",$document,$links); - + // catenate the non-empty matches from the conditional subpattern @@ -883,14 +885,14 @@ class Snoopy { if(!empty($val)) $match[] = $val; - } - + } + while(list($key,$val) = each($links[3])) { if(!empty($val)) $match[] = $val; - } - + } + // return the links return $match; } @@ -903,18 +905,18 @@ class Snoopy \*======================================================================*/ function _stripform($document) - { + { preg_match_all("'<\/?(FORM|INPUT|SELECT|TEXTAREA|(OPTION))[^<>]*>(?(2)(.*(?=<\/?(option|select)[^<>]*>[\r\n]*)|(?=[\r\n]*))|(?=[\r\n]*))'Usi",$document,$elements); - + // catenate the matches $match = implode("\r\n",$elements[0]); - + // return the links return $match; } - - + + /*======================================================================*\ Function: _striptext Purpose: strip the text from an html document @@ -924,11 +926,11 @@ class Snoopy function _striptext($document) { - + // I didn't use preg eval (//e) since that is only available in PHP 4.0. // so, list your entities one by one here. I included some of the // more common ones. - + $search = array("']*?>.*?'si", // strip out javascript "'<[\/\!]*?[^<>]*?>'si", // strip out html tags "'([\r\n])[\s]+'", // strip out white space @@ -977,9 +979,9 @@ class Snoopy "?", "?", ); - + $text = preg_replace($search,$replace,$document); - + return $text; } @@ -993,7 +995,7 @@ class Snoopy function _expandlinks($links,$URI) { - + preg_match("/^[^\?]+/",$URI,$match); $match = preg_replace("|/[^\/\.]+\.[^\/\.]+$|","",$match[0]); @@ -1001,21 +1003,21 @@ class Snoopy $match_part = parse_url($match); $match_root = $match_part["scheme"]."://".$match_part["host"]; - + $search = array( "|^http://".preg_quote($this->host)."|i", "|^(\/)|i", "|^(?!http://)(?!mailto:)|i", "|/\./|", "|/[^\/]+/\.\./|" ); - + $replace = array( "", $match_root."/", $match."/", "/", "/" - ); - + ); + $expandedLinks = preg_replace($search,$replace,$links); return $expandedLinks; @@ -1028,19 +1030,19 @@ class Snoopy $fp the current open file pointer $URI the full URI $body body contents to send if any (POST) - Output: + Output: \*======================================================================*/ - + function _httprequest($url,$fp,$URI,$http_method,$content_type="",$body="") { $cookie_headers = ''; if($this->passcookies && $this->_redirectaddr) $this->setcookies(); - + $URI_PARTS = parse_url($URI); if(empty($url)) $url = "/"; - $headers = $http_method." ".$url." ".$this->_httpversion."\r\n"; + $headers = $http_method." ".$url." ".$this->_httpversion."\r\n"; if(!empty($this->agent)) $headers .= "User-Agent: ".$this->agent."\r\n"; if(!empty($this->host) && !isset($this->rawheaders['Host'])) { @@ -1054,10 +1056,10 @@ class Snoopy if(!empty($this->referer)) $headers .= "Referer: ".$this->referer."\r\n"; if(!empty($this->cookies)) - { + { if(!is_array($this->cookies)) $this->cookies = (array)$this->cookies; - + reset($this->cookies); if ( count($this->cookies) > 0 ) { $cookie_headers .= 'Cookie: '; @@ -1065,7 +1067,7 @@ class Snoopy $cookie_headers .= $cookieKey."=".urlencode($cookieVal)."; "; } $headers .= substr($cookie_headers,0,-2) . "\r\n"; - } + } } if(!empty($this->rawheaders)) { @@ -1080,28 +1082,28 @@ class Snoopy $headers .= "; boundary=".$this->_mime_boundary; $headers .= "\r\n"; } - if(!empty($body)) + if(!empty($body)) $headers .= "Content-length: ".strlen($body)."\r\n"; - if(!empty($this->user) || !empty($this->pass)) + if(!empty($this->user) || !empty($this->pass)) $headers .= "Authorization: Basic ".base64_encode($this->user.":".$this->pass)."\r\n"; - + //add proxy auth headers - if(!empty($this->proxy_user)) + if(!empty($this->proxy_user)) $headers .= 'Proxy-Authorization: ' . 'Basic ' . base64_encode($this->proxy_user . ':' . $this->proxy_pass)."\r\n"; $headers .= "\r\n"; - + // set the read timeout if needed if ($this->read_timeout > 0) socket_set_timeout($fp, $this->read_timeout); $this->timed_out = false; - + fwrite($fp,$headers.$body,strlen($headers.$body)); - + $this->_redirectaddr = false; unset($this->headers); - + while($currentHeader = fgets($fp,$this->_maxlinelen)) { if ($this->read_timeout > 0 && $this->_check_timeout($fp)) @@ -1109,10 +1111,10 @@ class Snoopy $this->status=-100; return false; } - + if($currentHeader == "\r\n") break; - + // if a header begins with Location: or URI:, set the redirect if(preg_match("/^(Location:|URI:)/i",$currentHeader)) { @@ -1132,16 +1134,16 @@ class Snoopy else $this->_redirectaddr = $matches[2]; } - + if(preg_match("|^HTTP/|",$currentHeader)) { if(preg_match("|^HTTP/[^\s]*\s(.*?)\s|",$currentHeader, $status)) { $this->status= $status[1]; - } + } $this->response_code = $currentHeader; } - + $this->headers[] = $currentHeader; } @@ -1159,13 +1161,13 @@ class Snoopy $this->status=-100; return false; } - + // check if there is a a redirect meta tag - + if(preg_match("']*?content[\s]*=[\s]*[\"\']?\d+;[\s]*URL[\s]*=[\s]*([^\"\']*?)[\"\']?>'i",$results,$match)) { - $this->_redirectaddr = $this->_expandlinks($match[1],$URI); + $this->_redirectaddr = $this->_expandlinks($match[1],$URI); } // have we hit our frame depth and is there frame src to fetch? @@ -1181,7 +1183,7 @@ class Snoopy // no framed content else $this->results = $results; - + return true; } @@ -1191,21 +1193,21 @@ class Snoopy Input: $url the url to fetch $URI the full URI $body body contents to send if any (POST) - Output: + Output: \*======================================================================*/ - + function _httpsrequest($url,$URI,$http_method,$content_type="",$body="") - { + { if($this->passcookies && $this->_redirectaddr) $this->setcookies(); - $headers = array(); - + $headers = array(); + $URI_PARTS = parse_url($URI); if(empty($url)) $url = "/"; // GET ... header not needed for curl - //$headers[] = $http_method." ".$url." ".$this->_httpversion; + //$headers[] = $http_method." ".$url." ".$this->_httpversion; if(!empty($this->agent)) $headers[] = "User-Agent: ".$this->agent; if(!empty($this->host)) @@ -1218,10 +1220,10 @@ class Snoopy if(!empty($this->referer)) $headers[] = "Referer: ".$this->referer; if(!empty($this->cookies)) - { + { if(!is_array($this->cookies)) $this->cookies = (array)$this->cookies; - + reset($this->cookies); if ( count($this->cookies) > 0 ) { $cookie_str = 'Cookie: '; @@ -1244,43 +1246,43 @@ class Snoopy else $headers[] = "Content-type: $content_type"; } - if(!empty($body)) + if(!empty($body)) $headers[] = "Content-length: ".strlen($body); - if(!empty($this->user) || !empty($this->pass)) + if(!empty($this->user) || !empty($this->pass)) $headers[] = "Authorization: BASIC ".base64_encode($this->user.":".$this->pass); - + for($curr_header = 0; $curr_header < count($headers); $curr_header++) { $safer_header = strtr( $headers[$curr_header], "\"", " " ); $cmdline_params .= " -H \"".$safer_header."\""; } - + if(!empty($body)) $cmdline_params .= " -d \"$body\""; - + if($this->read_timeout > 0) $cmdline_params .= " -m ".$this->read_timeout; - + $headerfile = tempnam($temp_dir, "sno"); exec($this->curl_path." -k -D \"$headerfile\"".$cmdline_params." \"".escapeshellcmd($URI)."\"",$results,$return); - + if($return) { $this->error = "Error: cURL could not retrieve the document, error $return."; return false; } - - + + $results = implode("\r\n",$results); - + $result_headers = file("$headerfile"); - + $this->_redirectaddr = false; unset($this->headers); - + for($currentHeader = 0; $currentHeader < count($result_headers); $currentHeader++) { - + // if a header begins with Location: or URI:, set the redirect if(preg_match("/^(Location: |URI: )/i",$result_headers[$currentHeader])) { @@ -1300,7 +1302,7 @@ class Snoopy else $this->_redirectaddr = $matches[2]; } - + if(preg_match("|^HTTP/|",$result_headers[$currentHeader])) $this->response_code = $result_headers[$currentHeader]; @@ -1308,10 +1310,10 @@ class Snoopy } // check if there is a a redirect meta tag - + if(preg_match("']*?content[\s]*=[\s]*[\"\']?\d+;[\s]*URL[\s]*=[\s]*([^\"\']*?)[\"\']?>'i",$results,$match)) { - $this->_redirectaddr = $this->_expandlinks($match[1],$URI); + $this->_redirectaddr = $this->_expandlinks($match[1],$URI); } // have we hit our frame depth and is there frame src to fetch? @@ -1329,7 +1331,7 @@ class Snoopy $this->results = $results; unlink("$headerfile"); - + return true; } @@ -1337,7 +1339,7 @@ class Snoopy Function: setcookies() Purpose: set cookies for a redirection \*======================================================================*/ - + function setcookies() { for($x=0; $xheaders); $x++) @@ -1347,7 +1349,7 @@ class Snoopy } } - + /*======================================================================*\ Function: _check_timeout Purpose: checks whether timeout has occurred @@ -1371,13 +1373,13 @@ class Snoopy Purpose: make a socket connection Input: $fp file pointer \*======================================================================*/ - + function _connect(&$fp) { if(!empty($this->proxy_host) && !empty($this->proxy_port)) { $this->_isproxy = true; - + $host = $this->proxy_host; $port = $this->proxy_port; } @@ -1386,9 +1388,9 @@ class Snoopy $host = $this->host; $port = $this->port; } - + $this->status = 0; - + if($fp = fsockopen( $host, $port, @@ -1424,13 +1426,13 @@ class Snoopy Purpose: disconnect a socket connection Input: $fp file pointer \*======================================================================*/ - + function _disconnect($fp) { return(fclose($fp)); } - + /*======================================================================*\ Function: _prepare_post_body Purpose: Prepare post body according to encoding type @@ -1438,7 +1440,7 @@ class Snoopy $formfiles - form upload files Output: post body \*======================================================================*/ - + function _prepare_post_body($formvars, $formfiles) { settype($formvars, "array"); @@ -1447,7 +1449,7 @@ class Snoopy if (count($formvars) == 0 && count($formfiles) == 0) return; - + switch ($this->_submit_type) { case "application/x-www-form-urlencoded": reset($formvars); @@ -1463,7 +1465,7 @@ class Snoopy case "multipart/form-data": $this->_mime_boundary = "Snoopy".md5(uniqid(microtime())); - + reset($formvars); while(list($key,$val) = each($formvars)) { if (is_array($val) || is_object($val)) { @@ -1478,7 +1480,7 @@ class Snoopy $postdata .= "$val\r\n"; } } - + reset($formfiles); while (list($field_name, $file_names) = each($formfiles)) { settype($file_names, "array"); diff --git a/module/action/model.php b/module/action/model.php index 1f4ad3190d..f5f9ad45e2 100755 --- a/module/action/model.php +++ b/module/action/model.php @@ -1299,7 +1299,7 @@ class actionModel extends model if($history->diff != '') { $history->diff = str_replace(array('', '', '', ''), array('[ins]', '[/ins]', '[del]', '[/del]'), $history->diff); - $history->diff = ($history->field != 'subversion' and $history->field != 'git') ? htmlspecialchars($history->diff) : $history->diff; // Keep the diff link. + $history->diff = ($history->field != 'subversion' and $history->field != 'git') ? htmlSpecialString($history->diff) : $history->diff; // Keep the diff link. $history->diff = str_replace(array('[ins]', '[/ins]', '[del]', '[/del]'), array('', '', '', ''), $history->diff); $history->diff = nl2br($history->diff); $history->noTagDiff = $canChangeTag ? preg_replace('/<\/?([a-z][a-z0-9]*)[^\/]*\/?>/Ui', '', $history->diff) : ''; diff --git a/module/bug/control.php b/module/bug/control.php index d3d9486b1f..586f30e01c 100644 --- a/module/bug/control.php +++ b/module/bug/control.php @@ -614,7 +614,7 @@ class bug extends control $this->view->testtask = $testtask; $this->view->bugTitle = $title; $this->view->pri = $pri; - $this->view->steps = htmlspecialchars($steps); + $this->view->steps = htmlSpecialString($steps); $this->view->os = $os; $this->view->browser = $browser; $this->view->productMembers = $productMembers; diff --git a/module/bug/model.php b/module/bug/model.php index d374c314ef..fa57b87a62 100644 --- a/module/bug/model.php +++ b/module/bug/model.php @@ -193,7 +193,7 @@ class bugModel extends model $bug->{$extendField->field} = $this->post->{$extendField->field}[$i]; if(is_array($bug->{$extendField->field})) $bug->{$extendField->field} = join(',', $bug->{$extendField->field}); - $bug->{$extendField->field} = htmlspecialchars($bug->{$extendField->field}); + $bug->{$extendField->field} = htmlSpecialString($bug->{$extendField->field}); $message = $this->checkFlowRule($extendField, $bug->{$extendField->field}); if($message) die(js::alert($message)); } @@ -770,7 +770,7 @@ class bugModel extends model $bug->{$extendField->field} = $this->post->{$extendField->field}[$bugID]; if(is_array($bug->{$extendField->field})) $bug->{$extendField->field} = join(',', $bug->{$extendField->field}); - $bug->{$extendField->field} = htmlspecialchars($bug->{$extendField->field}); + $bug->{$extendField->field} = htmlSpecialString($bug->{$extendField->field}); $message = $this->checkFlowRule($extendField, $bug->{$extendField->field}); if($message) die(js::alert($message)); } diff --git a/module/bug/view/edit.html.php b/module/bug/view/edit.html.php index 437efffd65..552d3e2002 100644 --- a/module/bug/view/edit.html.php +++ b/module/bug/view/edit.html.php @@ -55,7 +55,7 @@ js::set('confirmUnlinkBuild' , sprintf($lang->bug->confirmUnlinkBuild, zget(
bug->legendSteps;?>
- steps), "rows='12' class='form-control kindeditor' hidefocus='true'");?> + steps), "rows='12' class='form-control kindeditor' hidefocus='true'");?>
diff --git a/module/build/view/edit.html.php b/module/build/view/edit.html.php index 6366cbf545..1dc35bea94 100644 --- a/module/build/view/edit.html.php +++ b/module/build/view/edit.html.php @@ -76,7 +76,7 @@ build->desc;?> - desc), "rows='10' class='form-control kindeditor' hidefocus='true'");?> + desc), "rows='10' class='form-control kindeditor' hidefocus='true'");?> diff --git a/module/caselib/model.php b/module/caselib/model.php index 6fd6b24c62..89ed3045e2 100644 --- a/module/caselib/model.php +++ b/module/caselib/model.php @@ -414,8 +414,8 @@ class caselibModel extends model if(empty($desc)) continue; $step = new stdclass(); $step->type = $data->stepType[$key][$id]; - $step->desc = htmlspecialchars($desc); - $step->expect = htmlspecialchars(trim($data->expect[$key][$id])); + $step->desc = htmlSpecialString($desc); + $step->expect = htmlSpecialString(trim($data->expect[$key][$id])); $steps[] = $step; } @@ -498,8 +498,8 @@ class caselibModel extends model $stepData->parent = ($stepData->type == 'item') ? $parentStepID : 0; $stepData->case = $caseID; $stepData->version = 1; - $stepData->desc = htmlspecialchars($desc); - $stepData->expect = htmlspecialchars(trim($data->expect[$key][$id])); + $stepData->desc = htmlSpecialString($desc); + $stepData->expect = htmlSpecialString(trim($data->expect[$key][$id])); $this->dao->insert(TABLE_CASESTEP)->data($stepData)->autoCheck()->exec(); if($stepData->type == 'group') $parentStepID = $this->dao->lastInsertID(); if($stepData->type == 'step') $parentStepID = 0; diff --git a/module/caselib/view/edit.html.php b/module/caselib/view/edit.html.php index 2b21f4aad9..49fc7577f9 100644 --- a/module/caselib/view/edit.html.php +++ b/module/caselib/view/edit.html.php @@ -25,7 +25,7 @@ caselib->desc;?> - desc), "rows=10 class='form-control'");?> + desc), "rows=10 class='form-control'");?> printExtendFields($lib, 'table');?> diff --git a/module/caselib/view/showimport.html.php b/module/caselib/view/showimport.html.php index dc251576cb..a2bb3dcff0 100644 --- a/module/caselib/view/showimport.html.php +++ b/module/caselib/view/showimport.html.php @@ -75,7 +75,7 @@ $(function() testcase->typeList, isset($case->type) ? $case->type : (!empty($case->id) ? $cases[$case->id]->type : ''), "class='form-control chosen'")?> testcase->stageList, !empty($case->stage) ? $case->stage : (!empty($case->id) ? $cases[$case->id]->stage : ''), "multiple='multiple' class='form-control chosen'")?> keywords) ? $case->keywords : "", "class='form-control'")?> - precondition) ? htmlspecialchars($case->precondition) : "", "class='form-control'")?> + precondition) ? htmlSpecialString($case->precondition) : "", "class='form-control'")?> @@ -86,8 +86,8 @@ $(function() ?> - - + +
diff --git a/module/common/view/action.html.php b/module/common/view/action.html.php index 5551886804..be5204fb64 100755 --- a/module/common/view/action.html.php +++ b/module/common/view/action.html.php @@ -72,7 +72,7 @@
id")?>'>
- comment), "rows='8' autofocus='autofocus'");?> + comment), "rows='8' autofocus='autofocus'");?>
save);?> diff --git a/module/doc/view/edit.html.php b/module/doc/view/edit.html.php index fa910f774d..2f2f1fa464 100644 --- a/module/doc/view/edit.html.php +++ b/module/doc/view/edit.html.php @@ -59,7 +59,7 @@ type == 'url') echo "class='hidden'"?>> doc->content;?> - type == 'url' ? '' : htmlspecialchars($doc->content), "style='width:100%; height:200px'") . html::hidden('contentType', $doc->contentType);?> + type == 'url' ? '' : htmlSpecialString($doc->content), "style='width:100%; height:200px'") . html::hidden('contentType', $doc->contentType);?> type != 'url') echo "class='hidden'"?>> doc->url;?> diff --git a/module/execution/view/edit.html.php b/module/execution/view/edit.html.php index 7328dee226..5a057a030a 100644 --- a/module/execution/view/edit.html.php +++ b/module/execution/view/edit.html.php @@ -161,7 +161,7 @@ execution->desc;?> - desc), "rows='6' class='form-control kindeditor' hidefocus='true'");?> + desc), "rows='6' class='form-control kindeditor' hidefocus='true'");?> printExtendFields($execution, 'table');?> diff --git a/module/file/model.php b/module/file/model.php index 5cc061e6f7..a27c80b173 100644 --- a/module/file/model.php +++ b/module/file/model.php @@ -154,7 +154,7 @@ class fileModel extends model $title = isset($_POST[$labelsName][$id]) ? $_POST[$labelsName][$id] : ''; $file['extension'] = $this->getExtension($filename); $file['pathname'] = $this->setPathName($id, $file['extension']); - $file['title'] = (!empty($title) and $title != $filename) ? htmlspecialchars($title) : $filename; + $file['title'] = (!empty($title) and $title != $filename) ? htmlSpecialString($title) : $filename; $file['title'] = $purifier->purify($file['title']); $file['size'] = $size[$id]; $file['tmpname'] = $tmp_name[$id]; @@ -169,7 +169,7 @@ class fileModel extends model $title = isset($_POST[$labelsName][0]) ? $_POST[$labelsName][0] : ''; $file['extension'] = $this->getExtension($name); $file['pathname'] = $this->setPathName(0, $file['extension']); - $file['title'] = (!empty($title) and $title != $name) ? htmlspecialchars($title) : $name; + $file['title'] = (!empty($title) and $title != $name) ? htmlSpecialString($title) : $name; $file['title'] = $purifier->purify($file['title']); $file['size'] = $size; $file['tmpname'] = $tmp_name; @@ -201,7 +201,7 @@ class fileModel extends model $file = array(); $file['id'] = 0; $file['extension'] = $this->getExtension($name); - $file['title'] = !empty($_POST['label']) ? htmlspecialchars($_POST['label']) : substr($name, 0, strpos($name, $file['extension']) - 1); + $file['title'] = !empty($_POST['label']) ? htmlSpecialString($_POST['label']) : substr($name, 0, strpos($name, $file['extension']) - 1); $file['title'] = $purifier->purify($file['title']); $file['size'] = $_POST['size']; $file['tmpname'] = $tmp_name; @@ -704,7 +704,7 @@ class fileModel extends model $content = $this->pasteImage($data->$editorID, $uid); if($content) $data->$editorID = $content; $data->$editorID = preg_replace("/ src=\"$readLinkReg\" /", ' src="' . $imgURL . '" ', $data->$editorID); - $data->$editorID = preg_replace("/ src=\"" . htmlspecialchars($readLinkReg) . "\" /", ' src="' . $imgURL . '" ', $data->$editorID); + $data->$editorID = preg_replace("/ src=\"" . htmlSpecialString($readLinkReg) . "\" /", ' src="' . $imgURL . '" ', $data->$editorID); preg_match_all('/ src="{([0-9]+)\.\w+}"/', $data->$editorID, $matchs); if($matchs[1]) diff --git a/module/file/view/download.html.php b/module/file/view/download.html.php index 6ac01fd194..58e05d34ce 100644 --- a/module/file/view/download.html.php +++ b/module/file/view/download.html.php @@ -43,7 +43,7 @@ $fileContent = helper::convertEncoding($fileContent, $encoding, $config->charset); } } - echo "
" . htmlspecialchars($fileContent) . "
"; + echo "
" . htmlSpecialString($fileContent) . "
"; ?>
diff --git a/module/file/view/export2xml.html.php b/module/file/view/export2xml.html.php index a5a9fe2dfa..66a50b9632 100644 --- a/module/file/view/export2xml.html.php +++ b/module/file/view/export2xml.html.php @@ -26,7 +26,7 @@ foreach($rows as $row) echo " \n"; foreach($fields as $fieldName => $fieldLabel) { - $fieldValue = isset($row->$fieldName) ? htmlspecialchars($row->$fieldName) : ''; + $fieldValue = isset($row->$fieldName) ? htmlSpecialString($row->$fieldName) : ''; echo " <$fieldName>$fieldValue\n"; } echo " \n"; diff --git a/module/mr/view/diff.html.php b/module/mr/view/diff.html.php index a4ff5ab6f9..3a5e0e20f0 100644 --- a/module/mr/view/diff.html.php +++ b/module/mr/view/diff.html.php @@ -76,7 +76,7 @@ type != 'new') echo $line->oldlc?> type != 'old') echo $line->newlc?> line = $repo->SCM == 'Subversion' ? htmlspecialchars($line->line) : $line->line; + $line->line = $repo->SCM == 'Subversion' ? htmlSpecialString($line->line) : $line->line; echo $line->type == 'old' ? preg_replace('/^\-/', '–', $line->line) : ($line->type == 'new' ? $line->line : ' ' . $line->line); ?> @@ -105,13 +105,13 @@ type?> type == 'custom') echo "line-old"?> code'>old[$oldlc])) $content->old[$oldlc] = ''; - $content->old[$oldlc] = $repo->SCM == 'Subversion' ? htmlspecialchars($content->old[$oldlc]) : $content->old[$oldlc]; + $content->old[$oldlc] = $repo->SCM == 'Subversion' ? htmlSpecialString($content->old[$oldlc]) : $content->old[$oldlc]; if(!empty($oldlc)) echo $line->type != 'all' ? preg_replace('/^\-/', '–', $content->old[$oldlc]) : ' ' . $content->old[$oldlc]; ?> type?> type == 'custom') echo "line-new"?> code'>new[$newlc])) $content->new[$newlc] = ''; - $content->new[$newlc] = $repo->SCM == 'Subversion' ? htmlspecialchars($content->new[$newlc]) : $content->new[$newlc]; + $content->new[$newlc] = $repo->SCM == 'Subversion' ? htmlSpecialString($content->new[$newlc]) : $content->new[$newlc]; if(!empty($newlc)) echo $line->type != 'all' ? $content->new[$newlc] : ' ' . $content->new[$newlc]; ?> ' style='overflow:visible'>RD, "class='form-control picker-select'");?> '>product->typeList, $products[$productID]->type, "class='form-control'");?> '>product->statusList, $products[$productID]->status, "class='form-control'");?> - '>desc), "rows='1' class='form-control autosize'");?> + '>desc), "rows='1' class='form-control autosize'");?> '> product->acls, $products[$productID]->acl));?> printExtendFields($product, 'table');?> product->desc;?> - desc), "rows='8' class='form-control'");?> + desc), "rows='8' class='form-control'");?> product->acl;?> diff --git a/module/productplan/view/edit.html.php b/module/productplan/view/edit.html.php index e8ac1dc53a..c1814da079 100644 --- a/module/productplan/view/edit.html.php +++ b/module/productplan/view/edit.html.php @@ -56,7 +56,7 @@ printExtendFields($plan, 'table', 'columns=3');?> productplan->desc;?> - desc), "rows='10' class='form-control kindeditor' hidefocus='true'");?> + desc), "rows='10' class='form-control kindeditor' hidefocus='true'");?> diff --git a/module/projectrelease/view/edit.html.php b/module/projectrelease/view/edit.html.php index e195cc8f4d..60e7796607 100644 --- a/module/projectrelease/view/edit.html.php +++ b/module/projectrelease/view/edit.html.php @@ -50,7 +50,7 @@ printExtendFields($release, 'table');?> release->desc;?> - desc), "rows=10 class='form-control kindeditor' hidefocus='true'");?> + desc), "rows=10 class='form-control kindeditor' hidefocus='true'");?> release->notify;?> diff --git a/module/release/view/edit.html.php b/module/release/view/edit.html.php index 8b00e012d1..fc023286e7 100644 --- a/module/release/view/edit.html.php +++ b/module/release/view/edit.html.php @@ -50,7 +50,7 @@ printExtendFields($release, 'table');?> release->desc;?> - desc), "rows=10 class='form-control kindeditor' hidefocus='true'");?> + desc), "rows=10 class='form-control kindeditor' hidefocus='true'");?> release->notify;?> diff --git a/module/repo/model.php b/module/repo/model.php index 54aff7abed..d61b0b5bee 100644 --- a/module/repo/model.php +++ b/module/repo/model.php @@ -643,7 +643,7 @@ class repoModel extends model $commit->repo = $repoID; $commit->commit = $version; - $commit->comment = htmlspecialchars($commit->comment); + $commit->comment = htmlSpecialString($commit->comment); $this->dao->insert(TABLE_REPOHISTORY)->data($commit)->exec(); if(!dao::isError()) { @@ -695,7 +695,7 @@ class repoModel extends model $history->committer = $commit->committer; $history->time = $commit->time; $history->commit = $version; - $history->comment = htmlspecialchars($commit->comment); + $history->comment = htmlSpecialString($commit->comment); $this->dao->insert(TABLE_REPOHISTORY)->data($history)->exec(); if(!dao::isError()) { @@ -1441,7 +1441,7 @@ class repoModel extends model $action->actor = $log->author; $action->date = $log->date; - $action->comment = htmlspecialchars($this->iconvComment($log->msg, $encodings)); + $action->comment = htmlSpecialString($this->iconvComment($log->msg, $encodings)); $action->extra = $scm == 'svn' ? $log->revision : substr($log->revision, 0, 10); $this->loadModel('action'); diff --git a/module/repo/view/ajaxsidecommits.html.php b/module/repo/view/ajaxsidecommits.html.php index 89e7c656d6..ad16a62fc8 100644 --- a/module/repo/view/ajaxsidecommits.html.php +++ b/module/repo/view/ajaxsidecommits.html.php @@ -43,7 +43,7 @@ if(isset($entry)) $pathInfo .= '&type=file'; time, 0, 10);?> committer;?> - comment, ENT_QUOTES);?> + comment, ENT_QUOTES);?> comment?> diff --git a/module/repo/view/blame.html.php b/module/repo/view/blame.html.php index 2a87de831e..5a5a5b1141 100644 --- a/module/repo/view/blame.html.php +++ b/module/repo/view/blame.html.php @@ -93,7 +93,7 @@ css::import($jsRoot . 'misc/highlight/styles/github.css'); } ?> -
+
diff --git a/module/repo/view/browse.html.php b/module/repo/view/browse.html.php index d303e166c4..5a5d289fe0 100644 --- a/module/repo/view/browse.html.php +++ b/module/repo/view/browse.html.php @@ -91,7 +91,7 @@ SCM == 'Subversion' ? $info->revision : substr($info->revision, 0, 10);?> date, 0, 10)?> committer?> - comment, ENT_QUOTES);?> + comment, ENT_QUOTES);?> diff --git a/module/repo/view/diff.html.php b/module/repo/view/diff.html.php index 8803c3e0d2..a9ceeb1222 100644 --- a/module/repo/view/diff.html.php +++ b/module/repo/view/diff.html.php @@ -104,7 +104,7 @@ type != 'new') echo $line->oldlc?> type != 'old') echo $line->newlc?> line = $repo->SCM == 'Subversion' ? htmlspecialchars($line->line) : $line->line; + $line->line = $repo->SCM == 'Subversion' ? htmlSpecialString($line->line) : $line->line; echo $line->type == 'old' ? preg_replace('/^\-/', '–', $line->line) : ($line->type == 'new' ? $line->line : ' ' . $line->line); ?> @@ -133,13 +133,13 @@ type?> type == 'custom') echo "line-old"?> code'>old[$oldlc])) $content->old[$oldlc] = ''; - $content->old[$oldlc] = $repo->SCM == 'Subversion' ? htmlspecialchars($content->old[$oldlc]) : $content->old[$oldlc]; + $content->old[$oldlc] = $repo->SCM == 'Subversion' ? htmlSpecialString($content->old[$oldlc]) : $content->old[$oldlc]; if(!empty($oldlc)) echo $line->type != 'all' ? preg_replace('/^\-/', '–', $content->old[$oldlc]) : ' ' . $content->old[$oldlc]; ?> type?> type == 'custom') echo "line-new"?> code'>new[$newlc])) $content->new[$newlc] = ''; - $content->new[$newlc] = $repo->SCM == 'Subversion' ? htmlspecialchars($content->new[$newlc]) : $content->new[$newlc]; + $content->new[$newlc] = $repo->SCM == 'Subversion' ? htmlSpecialString($content->new[$newlc]) : $content->new[$newlc]; if(!empty($newlc)) echo $line->type != 'all' ? $content->new[$newlc] : ' ' . $content->new[$newlc]; ?> $revisionName";
repo->createLink('download', "repoID=$repoID&path=" . $this->repo->encodePath($entry) . "&fromRevision=$revision"), "", 'hiddenwin', "title='{$lang->repo->download}'"); ?>
-
+
diff --git a/module/story/control.php b/module/story/control.php index 6aebfcb8ec..ec4f979d37 100644 --- a/module/story/control.php +++ b/module/story/control.php @@ -224,8 +224,8 @@ class story extends control $moduleID = $story->module; $estimate = $story->estimate; $title = $story->title; - $spec = htmlspecialchars($story->spec); - $verify = htmlspecialchars($story->verify); + $spec = htmlSpecialString($story->spec); + $verify = htmlSpecialString($story->verify); $keywords = $story->keywords; $mailto = $story->mailto; } @@ -1205,7 +1205,7 @@ class story extends control { foreach($allChanges as $storyID => $changes) { - $actionID = $this->action->create('story', $storyID, 'Closed', htmlspecialchars($this->post->comments[$storyID]), ucfirst($this->post->closedReasons[$storyID]) . ($this->post->duplicateStoryIDList[$storyID] ? ':' . (int)$this->post->duplicateStoryIDList[$storyID] : '')); + $actionID = $this->action->create('story', $storyID, 'Closed', htmlSpecialString($this->post->comments[$storyID]), ucfirst($this->post->closedReasons[$storyID]) . ($this->post->duplicateStoryIDList[$storyID] ? ':' . (int)$this->post->duplicateStoryIDList[$storyID] : '')); $this->action->logHistory($actionID, $changes); } } diff --git a/module/story/model.php b/module/story/model.php index 06c0220413..31c0fafe58 100644 --- a/module/story/model.php +++ b/module/story/model.php @@ -474,7 +474,7 @@ class storyModel extends model $story->{$extendField->field} = $this->post->{$extendField->field}[$i]; if(is_array($story->{$extendField->field})) $story->{$extendField->field} = join(',', $story->{$extendField->field}); - $story->{$extendField->field} = htmlspecialchars($story->{$extendField->field}); + $story->{$extendField->field} = htmlSpecialString($story->{$extendField->field}); $message = $this->checkFlowRule($extendField, $story->{$extendField->field}); if($message) die(js::alert($message)); } @@ -1190,7 +1190,7 @@ class storyModel extends model $story->{$extendField->field} = $this->post->{$extendField->field}[$storyID]; if(is_array($story->{$extendField->field})) $story->{$extendField->field} = join(',', $story->{$extendField->field}); - $story->{$extendField->field} = htmlspecialchars($story->{$extendField->field}); + $story->{$extendField->field} = htmlSpecialString($story->{$extendField->field}); $message = $this->checkFlowRule($extendField, $story->{$extendField->field}); if($message) die(js::alert($message)); } diff --git a/module/story/view/change.html.php b/module/story/view/change.html.php index 9045db91cb..9b52368be0 100644 --- a/module/story/view/change.html.php +++ b/module/story/view/change.html.php @@ -55,11 +55,11 @@ story->spec;?> - spec), 'rows=8 class="form-control"');?>story->specTemplate;?> + spec), 'rows=8 class="form-control"');?>story->specTemplate;?> story->verify;?> - verify), 'rows=6 class="form-control"');?> + verify), 'rows=6 class="form-control"');?> story->comment;?> diff --git a/module/story/view/create.html.php b/module/story/view/create.html.php index 296bc4fb49..44ccc77ded 100644 --- a/module/story/view/create.html.php +++ b/module/story/view/create.html.php @@ -214,7 +214,7 @@ story->spec;?> fetch('user', 'ajaxPrintTemplates', 'type=story&link=spec');?> - story->specTemplate . "\n" . $lang->noticePasteImg) . "'");?> + story->specTemplate . "\n" . $lang->noticePasteImg) . "'");?> diff --git a/module/task/model.php b/module/task/model.php index 52acee0b86..04742be2ba 100644 --- a/module/task/model.php +++ b/module/task/model.php @@ -325,7 +325,7 @@ class taskModel extends model $data[$i]->{$extendField->field} = $this->post->{$extendField->field}[$i]; if(is_array($data[$i]->{$extendField->field})) $data[$i]->{$extendField->field} = join(',', $data[$i]->{$extendField->field}); - $data[$i]->{$extendField->field} = htmlspecialchars($data[$i]->{$extendField->field}); + $data[$i]->{$extendField->field} = htmlSpecialString($data[$i]->{$extendField->field}); $message = $this->checkFlowRule($extendField, $data[$i]->{$extendField->field}); if($message) { @@ -1140,7 +1140,7 @@ class taskModel extends model $task->{$extendField->field} = $this->post->{$extendField->field}[$taskID]; if(is_array($task->{$extendField->field})) $task->{$extendField->field} = join(',', $task->{$extendField->field}); - $task->{$extendField->field} = htmlspecialchars($task->{$extendField->field}); + $task->{$extendField->field} = htmlSpecialString($task->{$extendField->field}); $message = $this->checkFlowRule($extendField, $task->{$extendField->field}); if($message) die(js::alert($message)); } diff --git a/module/task/view/create.html.php b/module/task/view/create.html.php index 8803c62b25..5549d355b6 100644 --- a/module/task/view/create.html.php +++ b/module/task/view/create.html.php @@ -201,7 +201,7 @@ task->desc;?> fetch('user', 'ajaxPrintTemplates', 'type=task&link=desc');?> - desc), "rows='10' class='form-control'");?> + desc), "rows='10' class='form-control'");?> diff --git a/module/task/view/edit.html.php b/module/task/view/edit.html.php index 5c3862a9c4..c0bf2b72a4 100644 --- a/module/task/view/edit.html.php +++ b/module/task/view/edit.html.php @@ -62,7 +62,7 @@
task->desc;?>
- desc), "rows='8' class='form-control'");?> + desc), "rows='8' class='form-control'");?>
diff --git a/module/testcase/model.php b/module/testcase/model.php index 12a3fdd97c..26447413c7 100644 --- a/module/testcase/model.php +++ b/module/testcase/model.php @@ -79,8 +79,8 @@ class testcaseModel extends model $step->parent = ($step->type == 'item') ? $parentStepID : 0; $step->case = $caseID; $step->version = 1; - $step->desc = htmlspecialchars($stepDesc); - $step->expect = $step->type == 'group' ? '' : htmlspecialchars($this->post->expects[$stepID]); + $step->desc = htmlSpecialString($stepDesc); + $step->expect = $step->type == 'group' ? '' : htmlSpecialString($this->post->expects[$stepID]); $this->dao->insert(TABLE_CASESTEP)->data($step)->autoCheck()->exec(); if($step->type == 'group') $parentStepID = $this->dao->lastInsertID(); if($step->type == 'step') $parentStepID = 0; @@ -173,7 +173,7 @@ class testcaseModel extends model $data[$i]->{$extendField->field} = $this->post->{$extendField->field}[$i]; if(is_array($data[$i]->{$extendField->field})) $data[$i]->{$extendField->field} = join(',', $data[$i]->{$extendField->field}); - $data[$i]->{$extendField->field} = htmlspecialchars($data[$i]->{$extendField->field}); + $data[$i]->{$extendField->field} = htmlSpecialString($data[$i]->{$extendField->field}); $message = $this->checkFlowRule($extendField, $data[$i]->{$extendField->field}); if($message) die(js::alert($message)); } @@ -714,8 +714,8 @@ class testcaseModel extends model $step->parent = ($step->type == 'item') ? $parentStepID : 0; $step->case = $caseID; $step->version = $version; - $step->desc = htmlspecialchars($stepDesc); - $step->expect = $step->type == 'group' ? '' : htmlspecialchars($this->post->expects[$stepID]); + $step->desc = htmlSpecialString($stepDesc); + $step->expect = $step->type == 'group' ? '' : htmlSpecialString($this->post->expects[$stepID]); $this->dao->insert(TABLE_CASESTEP)->data($step)->autoCheck()->exec(); if($step->type == 'group') $parentStepID = $this->dao->lastInsertID(); if($step->type == 'step') $parentStepID = 0; @@ -893,7 +893,7 @@ class testcaseModel extends model $case->{$extendField->field} = $this->post->{$extendField->field}[$caseID]; if(is_array($case->{$extendField->field})) $case->{$extendField->field} = join(',', $case->{$extendField->field}); - $case->{$extendField->field} = htmlspecialchars($case->{$extendField->field}); + $case->{$extendField->field} = htmlSpecialString($case->{$extendField->field}); $message = $this->checkFlowRule($extendField, $case->{$extendField->field}); if($message) die(js::alert($message)); } @@ -1193,8 +1193,8 @@ class testcaseModel extends model if(empty($desc)) continue; $step = new stdclass(); $step->type = $data->stepType[$key][$id]; - $step->desc = htmlspecialchars($desc); - $step->expect = htmlspecialchars(trim($this->post->expect[$key][$id])); + $step->desc = htmlSpecialString($desc); + $step->expect = htmlSpecialString(trim($this->post->expect[$key][$id])); $steps[] = $step; } @@ -1285,8 +1285,8 @@ class testcaseModel extends model $stepData->parent = ($stepData->type == 'item') ? $parentStepID : 0; $stepData->case = $caseID; $stepData->version = 1; - $stepData->desc = htmlspecialchars($desc); - $stepData->expect = htmlspecialchars($this->post->expect[$key][$id]); + $stepData->desc = htmlSpecialString($desc); + $stepData->expect = htmlSpecialString($this->post->expect[$key][$id]); $this->dao->insert(TABLE_CASESTEP)->data($stepData)->autoCheck()->exec(); if($stepData->type == 'group') $parentStepID = $this->dao->lastInsertID(); if($stepData->type == 'step') $parentStepID = 0; diff --git a/module/testcase/view/showimport.html.php b/module/testcase/view/showimport.html.php index f084e44a21..0b6cbc545a 100644 --- a/module/testcase/view/showimport.html.php +++ b/module/testcase/view/showimport.html.php @@ -79,7 +79,7 @@ $(function() echo html::hidden("keywords[$key]", isset($case->keywords) ? $case->keywords : ""); ?> - title, ENT_QUOTES), "class='form-control'")?> + title, ENT_QUOTES), "class='form-control'")?> module) ? $case->module : ((!empty($case->id) and isset($cases[$case->id])) ? $cases[$case->id]->module : ''), "class='form-control chosen moduleChange'")?> @@ -89,7 +89,7 @@ $(function() testcase->priList, isset($case->pri) ? $case->pri : ((!empty($case->id) and isset($cases[$case->id])) ? $cases[$case->id]->pri : ''), "class='form-control chosen'")?> testcase->typeList, isset($case->type) ? $case->type : '', "class='form-control chosen'")?> testcase->stageList, !empty($case->stage) ? $case->stage : ((!empty($case->id) and isset($cases[$case->id])) ? $cases[$case->id]->stage : ''), "multiple='multiple' class='form-control chosen'")?> - precondition) ? htmlspecialchars($case->precondition) : "", "class='form-control'")?> + precondition) ? htmlSpecialString($case->precondition) : "", "class='form-control'")?> loadModel('flow');?> @@ -103,8 +103,8 @@ $(function() - - + + diff --git a/module/testcase/view/view.html.php b/module/testcase/view/view.html.php index ae014608b8..b87f82e4bf 100644 --- a/module/testcase/view/view.html.php +++ b/module/testcase/view/view.html.php @@ -103,7 +103,7 @@ xml)):?>
testcase->xml;?>
-
xml));?>
+
xml));?>
fetch('file', 'printFiles', array('files' => $case->files, 'fieldset' => 'true', 'object' => $case));?> diff --git a/module/testsuite/view/edit.html.php b/module/testsuite/view/edit.html.php index 807ea8c7c5..7991c10536 100644 --- a/module/testsuite/view/edit.html.php +++ b/module/testsuite/view/edit.html.php @@ -25,7 +25,7 @@ testsuite->desc;?> - desc), "rows=10 class='form-control'");?> + desc), "rows=10 class='form-control'");?> printExtendFields($suite, 'table');?> type != 'library'):?> diff --git a/module/testtask/view/edit.html.php b/module/testtask/view/edit.html.php index 73ddc6c136..950131c5ef 100644 --- a/module/testtask/view/edit.html.php +++ b/module/testtask/view/edit.html.php @@ -77,7 +77,7 @@ testtask->desc;?> - desc), "rows=10 class='form-control'");?> + desc), "rows=10 class='form-control'");?> comment;?> diff --git a/module/testtask/view/unitgroup.html.php b/module/testtask/view/unitgroup.html.php index 905f3b0a12..9b4bed3164 100644 --- a/module/testtask/view/unitgroup.html.php +++ b/module/testtask/view/unitgroup.html.php @@ -43,7 +43,7 @@ pri;?>' title='testcase->priList, $case->pri, $case->pri);?>'>testcase->priList, $case->pri, $case->pri);?> - case&version={$case->version}&from=testtask&task=$taskID", $case->title)) echo $case->title;?> + case&version={$case->version}&from=testtask&task=$taskID", $case->title)) echo $case->title;?> lastRunner);?> lastRunDate)) echo date(DT_MONTHTIME1, strtotime($case->lastRunDate));?> lastRunResult) echo $lang->testcase->resultList[$case->lastRunResult];?> diff --git a/module/todo/view/edit.html.php b/module/todo/view/edit.html.php index 4d754ab2a7..86fd440a79 100644 --- a/module/todo/view/edit.html.php +++ b/module/todo/view/edit.html.php @@ -147,7 +147,7 @@
- desc), "rows='8' class='form-control'");?> + desc), "rows='8' class='form-control'");?>