From e41a21b40819479e2c871ec48cc500324daa78a1 Mon Sep 17 00:00:00 2001
From: wangyidong <yidong@cnezsoft.com>
Date: Tue, 24 Sep 2019 09:17:49 +0800
Subject: [PATCH]  * fix bug #2766.

---
 module/testcase/model.php          | 8 ++++----
 module/testcase/view/view.html.php | 4 ++--
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/module/testcase/model.php b/module/testcase/model.php
index 06e0ec8116..8b72d22218 100644
--- a/module/testcase/model.php
+++ b/module/testcase/model.php
@@ -1103,8 +1103,8 @@ class testcaseModel extends model
                         if(empty($desc)) continue;
                         $step = new stdclass();
                         $step->type   = $data->stepType[$key][$id];
-                        $step->desc   = $desc;
-                        $step->expect = trim($this->post->expect[$key][$id]);
+                        $step->desc    = htmlspecialchars($desc);
+                        $step->expect  = htmlspecialchars(trim($this->post->expect[$key][$id]));
 
                         $steps[] = $step;
                     }
@@ -1152,7 +1152,7 @@ class testcaseModel extends model
                             $stepData->parent  = ($stepData->type == 'item') ? $parentStepID : 0;
                             $stepData->case    = $caseID;
                             $stepData->version = $version;
-                            $stepData->desc    = $step['desc'];
+                            $stepData->desc    = htmlspecialchars($step['desc']);
                             $stepData->expect  = htmlspecialchars($step['expect']);
                             $this->dao->insert(TABLE_CASESTEP)->data($stepData)->autoCheck()->exec();
                             if($stepData->type == 'group') $parentStepID = $this->dao->lastInsertID();
@@ -1189,7 +1189,7 @@ class testcaseModel extends model
                         $stepData->parent  = ($stepData->type == 'item') ? $parentStepID : 0;
                         $stepData->case    = $caseID;
                         $stepData->version = 1;
-                        $stepData->desc    = $desc;
+                        $stepData->desc    = htmlspecialchars($desc);
                         $stepData->expect  = htmlspecialchars($this->post->expect[$key][$id]);
                         $this->dao->insert(TABLE_CASESTEP)->data($stepData)->autoCheck()->exec();
                         if($stepData->type == 'group') $parentStepID = $this->dao->lastInsertID();
diff --git a/module/testcase/view/view.html.php b/module/testcase/view/view.html.php
index cba1543a51..9addab92ad 100644
--- a/module/testcase/view/view.html.php
+++ b/module/testcase/view/view.html.php
@@ -66,7 +66,7 @@
             <thead>
               <tr>
                 <th class='w-50px'><?php echo $lang->testcase->stepID;?></th>
-                <th class='w-p70 text-left'><?php echo $lang->testcase->stepDesc;?></th>
+                <th class='w-p60 text-left'><?php echo $lang->testcase->stepDesc;?></th>
                 <th class='text-left'><?php echo $lang->testcase->stepExpect;?></th>
               </tr>
             </thead>
@@ -85,7 +85,7 @@
                 echo "<th class='step-id'>$stepId</th>";
                 echo "<td class='text-left'><div class='input-group'>";
                 if($step->type == 'item') echo "<span class='step-item-id'>{$stepId}.{$childId}</span>";
-                echo nl2br(str_replace(' ', '&nbsp;', htmlspecialchars($step->desc))) . "</td>";
+                echo nl2br(str_replace(' ', '&nbsp;', $step->desc)) . "</td>";
                 echo "<td class='text-left'>" . nl2br(str_replace(' ', '&nbsp;', $step->expect)) . "</div></td>";
                 echo "</tr>";
                 $childId ++;