From e8fb9449f6c1c30e116779144f3f537b4a290db7 Mon Sep 17 00:00:00 2001 From: Coleman Watts Date: Mon, 1 Jun 2015 16:53:58 -0400 Subject: [PATCH] CRM-16601 - Fix string escaping in js --- CRM/Contact/Form/Contact.php | 5 ++--- CRM/Core/BAO/UFGroup.php | 5 ++--- 2 files changed, 4 insertions(+), 6 deletions(-) diff --git a/CRM/Contact/Form/Contact.php b/CRM/Contact/Form/Contact.php index 7a8596a6b5..3902f0f1ec 100644 --- a/CRM/Contact/Form/Contact.php +++ b/CRM/Contact/Form/Contact.php @@ -735,14 +735,13 @@ class CRM_Contact_Form_Contact extends CRM_Core_Form { } if ($this->_action == CRM_Core_Action::UPDATE) { - $deleteExtra = ts('Are you sure you want to delete contact image.'); + $deleteExtra = json_encode(ts('Are you sure you want to delete contact image.')); $deleteURL = array( CRM_Core_Action::DELETE => array( 'name' => ts('Delete Contact Image'), 'url' => 'civicrm/contact/image', 'qs' => 'reset=1&cid=%%id%%&action=delete', - 'extra' => - 'onclick = "if (confirm( \'' . $deleteExtra . '\' ) ) this.href+=\'&confirmed=1\'; else return false;"', + 'extra' => 'onclick = "' . htmlspecialchars("if (confirm($deleteExtra)) this.href+='&confirmed=1'; else return false;") . '"', ), ); $deleteURL = CRM_Core_Action::formLink($deleteURL, diff --git a/CRM/Core/BAO/UFGroup.php b/CRM/Core/BAO/UFGroup.php index 2c90b4bbed..d2ae65bcd7 100644 --- a/CRM/Core/BAO/UFGroup.php +++ b/CRM/Core/BAO/UFGroup.php @@ -1835,14 +1835,13 @@ AND ( entity_id IS NULL OR entity_id <= 0 ) $selectAttributes = array('class' => 'crm-select2', 'placeholder' => TRUE); if ($fieldName == 'image_URL' && $mode == CRM_Profile_Form::MODE_EDIT) { - $deleteExtra = ts('Are you sure you want to delete contact image.'); + $deleteExtra = json_encode(ts('Are you sure you want to delete contact image.')); $deleteURL = array( CRM_Core_Action::DELETE => array( 'name' => ts('Delete Contact Image'), 'url' => 'civicrm/contact/image', 'qs' => 'reset=1&id=%%id%%&gid=%%gid%%&action=delete', - 'extra' => - 'onclick = "if (confirm( \'' . $deleteExtra . '\' ) ) this.href+=\'&confirmed=1\'; else return false;"', + 'extra' => 'onclick = "' . htmlspecialchars("if (confirm($deleteExtra)) this.href+='&confirmed=1'; else return false;") . '"', ), ); $deleteURL = CRM_Core_Action::formLink($deleteURL, -- 2.25.1