From 5f85fcd863fe261921953ea3bd1742f3e1b7cf68 Mon Sep 17 00:00:00 2001 From: ArthurHoaro Date: Thu, 11 Jun 2015 13:53:27 +0200 Subject: Working on shaarli/Shaarli#224 I reviewed character escaping everywhere with the following ideas: * use a single common function to escape user data: `escape` using `htmlspecialchars`. * sanitize fields in `index.php` after reading them from datastore and before sending them to templates. It means no escaping function in Twig templates. 2 reasons: * it reduces risks of security issue for future user made templates * more readable templates * sanitize user configuration fields after loading them. --- tpl/daily.html | 4 ++-- tpl/dailyrss.html | 6 +++--- tpl/editlink.html | 10 +++++----- tpl/import.html | 4 ++-- tpl/linklist.html | 10 +++++----- tpl/loginform.html | 2 +- tpl/page.footer.html | 2 +- tpl/page.header.html | 2 +- tpl/picwall.html | 2 +- tpl/tagcloud.html | 2 +- 10 files changed, 22 insertions(+), 22 deletions(-) (limited to 'tpl') diff --git a/tpl/daily.html b/tpl/daily.html index 0f762490..38aa4012 100644 --- a/tpl/daily.html +++ b/tpl/daily.html @@ -36,12 +36,12 @@ {if="$link.tags"}
{loop="link.taglist"} - {$value|htmlspecialchars} - + {$value} - {/loop}
{/if}
- {$link.title|htmlspecialchars} + {$link.title}
{if="$link.thumbnail"}
{$link.thumbnail}
diff --git a/tpl/dailyrss.html b/tpl/dailyrss.html index a9b11e18..1b7ab8e9 100644 --- a/tpl/dailyrss.html +++ b/tpl/dailyrss.html @@ -1,7 +1,7 @@ {loop="links"} -

{$value.title|htmlspecialchars}

- {if="!$GLOBALS['config']['HIDE_TIMESTAMPS']"}{function="strftime('%c', $value.timestamp)"} - {/if}{if="$value.tags"}{$value.tags|htmlspecialchars}{/if}
- {$value.url|htmlspecialchars}
+

{$value.title}

+ {if="!$GLOBALS['config']['HIDE_TIMESTAMPS']"}{function="strftime('%c', $value.timestamp)"} - {/if}{if="$value.tags"}{$value.tags}{/if}
+ {$value.url}
{if="$value.thumbnail"}{$value.thumbnail}{/if}
{if="$value.description"}{$value.formatedDescription}{/if}

diff --git a/tpl/editlink.html b/tpl/editlink.html index 0276f088..6737c412 100644 --- a/tpl/editlink.html +++ b/tpl/editlink.html @@ -15,11 +15,11 @@
-

-

-

+

+

+


-
{if="($link_is_new && $GLOBALS['privateLinkByDefault']==true) || $link.private == true"} @@ -32,7 +32,7 @@ {if="!$link_is_new"}{/if} - {if="$http_referer"}{/if} + {if="$http_referer"}{/if}
diff --git a/tpl/import.html b/tpl/import.html index 9ac3c2f9..6c4f9421 100644 --- a/tpl/import.html +++ b/tpl/import.html @@ -5,11 +5,11 @@ diff --git a/tpl/loginform.html b/tpl/loginform.html index 91b948dd..678375fd 100644 --- a/tpl/loginform.html +++ b/tpl/loginform.html @@ -17,7 +17,7 @@ Stay signed in (Do not check on public computers) - {if="$returnurl"}{/if} + {if="$returnurl"}{/if} {/if} diff --git a/tpl/page.footer.html b/tpl/page.footer.html index 42c621b9..8143669d 100644 --- a/tpl/page.footer.html +++ b/tpl/page.footer.html @@ -2,7 +2,7 @@ Shaarli - The personal, minimalist, super-fast, no-database delicious clone by the Shaarli community - Help/documentation {if="$newversion"} -
● Shaarli {$newversion|htmlspecialchars} is available.
+
● Shaarli {$newversion} is available.
{/if} {if="isLoggedIn()"} diff --git a/tpl/page.header.html b/tpl/page.header.html index 0fd65e40..2d186aa2 100644 --- a/tpl/page.header.html +++ b/tpl/page.header.html @@ -8,7 +8,7 @@