From d1d7d2ade952b5577f2e67f47930b3ad397cf1c2 Mon Sep 17 00:00:00 2001 From: Mathieu Lutfy Date: Tue, 11 Jul 2023 13:25:04 -0400 Subject: [PATCH] Add escape=htmlattribute option to the ts function --- CRM/Activity/Page/AJAX.php | 10 +++++----- CRM/Campaign/Page/DashBoard.php | 2 +- CRM/Core/BAO/CustomGroup.php | 2 +- CRM/Core/Form/Renderer.php | 4 ++-- CRM/Core/I18n.php | 3 +++ CRM/Report/Form/Contribute/HouseholdSummary.php | 2 +- CRM/Utils/Check/Component/Schema.php | 6 +++--- 7 files changed, 16 insertions(+), 13 deletions(-) diff --git a/CRM/Activity/Page/AJAX.php b/CRM/Activity/Page/AJAX.php index e06065e002..5c2c63ec9f 100644 --- a/CRM/Activity/Page/AJAX.php +++ b/CRM/Activity/Page/AJAX.php @@ -212,12 +212,12 @@ class CRM_Activity_Page_AJAX { } // view user links if (!empty($row['cid'])) { - $row['sort_name'] = ' 'htmlattribute']) . '" href=' . CRM_Utils_System::url('civicrm/contact/view', 'action=view&reset=1&cid=' . $row['cid']) . '>' . $row['sort_name'] . ''; } // email column links/icon if ($row['email']) { - $row['email'] = '' . CRM_Core_Page::crmIcon('fa-envelope') . ''; + $row['email'] = '' . CRM_Core_Page::crmIcon('fa-envelope') . ''; } // view end date if set @@ -240,10 +240,10 @@ class CRM_Activity_Page_AJAX { switch ($row['source']) { case 'caseRel': if (empty($row['end_date'])) { - $row['actions'] = '' . + $row['actions'] = '' . CRM_Core_Page::crmIcon('fa-pencil') . '' . - '' . + '' . CRM_Core_Page::crmIcon('fa-trash') . ''; @@ -251,7 +251,7 @@ class CRM_Activity_Page_AJAX { break; case 'caseRoles': - $row['actions'] = '' . + $row['actions'] = '' . CRM_Core_Page::crmIcon('fa-pencil') . ''; break; diff --git a/CRM/Campaign/Page/DashBoard.php b/CRM/Campaign/Page/DashBoard.php index 12973f87f7..b299681f14 100644 --- a/CRM/Campaign/Page/DashBoard.php +++ b/CRM/Campaign/Page/DashBoard.php @@ -318,7 +318,7 @@ class CRM_Campaign_Page_DashBoard extends CRM_Core_Page { $surveysData[$sid]['is_default'] = boolval($surveysData[$sid]['is_default']); if ($surveysData[$sid]['result_id']) { - $resultSet = '' . ts('Result Set') . ''; + $resultSet = '' . ts('Result Set') . ''; $surveysData[$sid]['result_id'] = $resultSet; } else { diff --git a/CRM/Core/BAO/CustomGroup.php b/CRM/Core/BAO/CustomGroup.php index ea50814bb8..6dae9a983b 100644 --- a/CRM/Core/BAO/CustomGroup.php +++ b/CRM/Core/BAO/CustomGroup.php @@ -1892,7 +1892,7 @@ ORDER BY civicrm_custom_group.weight, $displayName = CRM_Core_DAO::getFieldValue('CRM_Contact_DAO_Contact', $contactId, 'display_name'); if ($displayName) { $url = CRM_Utils_System::url(str_replace('[id]', $contactId, $path)); - $details[$groupID][$values['id']]['fields'][$k]['contact_ref_links'][] = '' . + $details[$groupID][$values['id']]['fields'][$k]['contact_ref_links'][] = '' . $displayName . ''; } } diff --git a/CRM/Core/Form/Renderer.php b/CRM/Core/Form/Renderer.php index bda38ac894..f85323feea 100644 --- a/CRM/Core/Form/Renderer.php +++ b/CRM/Core/Form/Renderer.php @@ -318,7 +318,7 @@ class CRM_Core_Form_Renderer extends HTML_QuickForm_Renderer_ArraySmarty { // Format contact as link if ($entity == 'Contact' && CRM_Contact_BAO_Contact_Permission::allow($val['id'], CRM_Core_Permission::VIEW)) { $url = CRM_Utils_System::url("civicrm/contact/view", ['reset' => 1, 'cid' => $val['id']]); - $val['label'] = '' . CRM_Utils_String::purifyHTML($val['label']) . ''; + $val['label'] = '' . CRM_Utils_String::purifyHTML($val['label']) . ''; } $display[] = $val['label']; } @@ -396,7 +396,7 @@ HEREDOC; // Initially hide if not needed // Note: visibility:hidden prevents layout jumping around unlike display:none $display = $field->getValue() !== NULL ? '' : ' style="visibility:hidden;"'; - $el['html'] .= ' '; + $el['html'] .= ' '; } } diff --git a/CRM/Core/I18n.php b/CRM/Core/I18n.php index 6e307334ca..7484564f5b 100644 --- a/CRM/Core/I18n.php +++ b/CRM/Core/I18n.php @@ -56,6 +56,9 @@ class CRM_Core_I18n { case 'js': return substr(json_encode($text, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT), 1, -1); + + case 'htmlattribute': + return htmlspecialchars($text, ENT_QUOTES); } return $text; } diff --git a/CRM/Report/Form/Contribute/HouseholdSummary.php b/CRM/Report/Form/Contribute/HouseholdSummary.php index 64537a2c64..9d08b36e52 100644 --- a/CRM/Report/Form/Contribute/HouseholdSummary.php +++ b/CRM/Report/Form/Contribute/HouseholdSummary.php @@ -448,7 +448,7 @@ class CRM_Report_Form_Contribute_HouseholdSummary extends CRM_Report_Form { $this->_absoluteUrl ); - $rows[$rowNum]['civicrm_contact_household_household_name'] = "" . $value . ''; + $rows[$rowNum]['civicrm_contact_household_household_name'] = " 'htmlattribute']) . "'>" . $value . ''; } $entryFound = TRUE; } diff --git a/CRM/Utils/Check/Component/Schema.php b/CRM/Utils/Check/Component/Schema.php index ac67ebb449..5244d453dc 100644 --- a/CRM/Utils/Check/Component/Schema.php +++ b/CRM/Utils/Check/Component/Schema.php @@ -147,14 +147,14 @@ class CRM_Utils_Check_Component_Schema extends CRM_Utils_Check_Component { 'id' => $field['cfid'], ]); $url = CRM_Utils_System::url('civicrm/admin/custom/group/field/update', "action=update&reset=1&gid={$customField['custom_group_id']}&id={$field['cfid']}", TRUE); - $fieldName = '' . $customField['label'] . ''; + $fieldName = '' . $customField['label'] . ''; } catch (CRM_Core_Exception $e) { $fieldName = '' . ts('Deleted') . ' - ' . ts('Field ID %1', [1 => $field['cfid']]) . ' '; } } - $groupEdit = ' '; - $groupConfig = ' '; + $groupEdit = ' '; + $groupConfig = ' '; $html .= "{$id} - {$field['title']} {$groupEdit} {$groupConfig}{$fieldName}"; } -- 2.25.1