From f03ef825825b5ae35c2a4cf276bb24d7eb289ba6 Mon Sep 17 00:00:00 2001 From: Sean Madsen Date: Tue, 19 Sep 2017 18:07:02 -0600 Subject: [PATCH] CRM-21006 - Escape all title and alt attributes This commit opportunistically adds HTML output encoding to all Smarty variables any time they appear within an HTML `title` or `alt` attribute. Why? Because this helps us prevent XSS and is very very unlikely to cause any unwanted side effects. Code locations found by searching the `templates` directory for: (title|alt)=(['"])((?!\2).)*\{\$((?!(\|(escape|crmDate))|\}).)+\}((?!\2).)*\2 --- templates/CRM/Activity/Form/ActivityLinks.tpl | 4 +-- templates/CRM/Admin/Page/Admin.tpl | 2 +- templates/CRM/Admin/Page/ConfigTaskList.tpl | 34 +++++++++---------- templates/CRM/Contact/Form/Edit/Tagtree.tpl | 2 +- templates/CRM/Contact/Page/Inline/Actions.tpl | 4 +-- templates/CRM/Contact/Page/View/Summary.tpl | 4 +-- .../Form/Contribution/PremiumBlock.tpl | 4 +-- templates/CRM/Dashlet/Page/Blog.tpl | 4 +-- templates/CRM/Event/Page/DashBoard.tpl | 4 +-- templates/CRM/Friend/Form.tpl | 2 +- templates/CRM/Report/Form/Contact/Detail.tpl | 4 +-- templates/CRM/Report/Form/Fields.tpl | 2 +- templates/CRM/Report/Form/Layout/Overlay.tpl | 2 +- templates/CRM/Report/Form/Layout/Table.tpl | 2 +- templates/CRM/Report/Page/InstanceList.tpl | 2 +- templates/CRM/Tag/Form/Tagtree.tpl | 2 +- templates/CRM/common/TabHeader.tpl | 2 +- 17 files changed, 40 insertions(+), 40 deletions(-) diff --git a/templates/CRM/Activity/Form/ActivityLinks.tpl b/templates/CRM/Activity/Form/ActivityLinks.tpl index d1f23594d2..a3b2332d81 100644 --- a/templates/CRM/Activity/Form/ActivityLinks.tpl +++ b/templates/CRM/Activity/Form/ActivityLinks.tpl @@ -68,10 +68,10 @@ {if $hookLinks} {foreach from=$hookLinks item=link}
  • - {if $link.img} - {$link.title}  + {$link.title|escape}  {/if} {$link.name} diff --git a/templates/CRM/Admin/Page/Admin.tpl b/templates/CRM/Admin/Page/Admin.tpl index 7144059856..0a00fa7e4e 100644 --- a/templates/CRM/Admin/Page/Admin.tpl +++ b/templates/CRM/Admin/Page/Admin.tpl @@ -72,7 +72,7 @@ {foreach from=$group.fields item=panelItem key=panelName name=groupLoop} - {$panelItem.title} + {$panelItem.title|escape} {$panelItem.title} diff --git a/templates/CRM/Admin/Page/ConfigTaskList.tpl b/templates/CRM/Admin/Page/ConfigTaskList.tpl index 752eb04196..0c665420d3 100644 --- a/templates/CRM/Admin/Page/ConfigTaskList.tpl +++ b/templates/CRM/Admin/Page/ConfigTaskList.tpl @@ -35,15 +35,15 @@ {ts}Site Configuration and Registration{/ts} - {ts}Localization{/ts} + {ts}Localization{/ts} {ts}Localization settings include user language, default currency and available countries for address input.{/ts} - {ts}Organization Address and Contact Info{/ts} + {ts}Organization Address and Contact Info{/ts} {ts}Organization name, email address for system-generated emails, organization address{/ts} - {ts}Enable components{/ts} + {ts}Enable components{/ts} {ts}Enable the required CiviCRM components.(CiviContribute, CiviEvent etc.){/ts} @@ -55,27 +55,27 @@ {ts}Viewing and Editing Contacts{/ts} - {ts}Display Preferences{/ts} + {ts}Display Preferences{/ts} {ts}Configure screen and form elements for Viewing Contacts, Editing Contacts, Advanced Search, Contact Dashboard and WYSIWYG Editor.{/ts} - {ts}Address Settings{/ts} + {ts}Address Settings{/ts} {ts}Format addresses in mailing labels, input forms and screen display.{/ts} - {ts}Mapping and Geocoding{/ts} + {ts}Mapping and Geocoding{/ts} {ts}Configure a mapping provider (e.g. Google or Yahoo) to display maps for contact addresses and event locations.{/ts} - {ts}Search Settings{/ts} + {ts}Search Settings{/ts} {ts}Adjust search behaviors including wildcards, and data to include in quick search results. Adjusting search settings can improve performance for larger datasets.{/ts} - {ts}Misc (Undelete, PDFs, Limits, Logging, Captcha, etc.){/ts} + {ts}Misc (Undelete, PDFs, Limits, Logging, Captcha, etc.){/ts} {ts}Version reporting and alerts, reCAPTCHA configuration and attachments.{/ts} - {ts}Contact Types{/ts} + {ts}Contact Types{/ts} {ts}You can modify the names of the built-in contact types (Individual, Household, Organizations), and you can create or modify "contact subtypes" for more specific uses (e.g. Student, Parent, Team, etc.).{/ts} @@ -83,11 +83,11 @@ {ts}Sending Emails (includes contribution receipts and event confirmations){/ts} - {ts}Outbound Email{/ts} + {ts}Outbound Email{/ts} {ts}Settings for outbound email - either SMTP server, port and authentication or Sendmail path and argument.{/ts} - {ts}From Email Addresses{/ts} + {ts}From Email Addresses{/ts} {ts}Define general email address(es) that can be used as the FROM address when sending email to contacts from within CiviCRM (e.g. info@example.org){/ts} @@ -95,7 +95,7 @@ {ts}Online Contributions / Online Membership Signup / Online Event Registration{/ts} - {ts}Payment Processors{/ts} + {ts}Payment Processors{/ts} {ts}Select and configure one or more payment processing services for online contributions, events and / or membership fees.{/ts} {if $config->userSystem->is_drupal EQ '1'} @@ -109,7 +109,7 @@ {/if} - {ts}System Workflow Templates{/ts} + {ts}System Workflow Templates{/ts} {ts}Review and modify the templates used for system-generated emails, including contribution receipts and event registration confirmations.{/ts} @@ -125,11 +125,11 @@ {ts}Organize your contacts{/ts} - {ts}Tags (Categories){/ts} + {ts}Tags (Categories){/ts} {ts}Tags can be assigned to any contact record, and are a convenient way to find contacts. You can create as many tags as needed to organize and segment your records.{/ts} - {ts}Manage Groups{/ts} + {ts}Manage Groups{/ts} {ts}Use Groups to organize contacts (e.g. these contacts are part of our 'Steering Committee').{/ts} @@ -137,11 +137,11 @@ {ts}Customize Data, Forms and Screens{/ts} - {ts}Custom Fields{/ts} + {ts}Custom Fields{/ts} {ts}Configure custom fields to collect and store custom data which is not included in the standard CiviCRM forms.{/ts} - {ts}Profiles{/ts} + {ts}Profiles{/ts} {ts}Profiles allow you to aggregate groups of fields and include them in your site as input forms, contact display pages, and search and listings features.{/ts} diff --git a/templates/CRM/Contact/Form/Edit/Tagtree.tpl b/templates/CRM/Contact/Form/Edit/Tagtree.tpl index d35eea13e3..cc5a884934 100644 --- a/templates/CRM/Contact/Form/Edit/Tagtree.tpl +++ b/templates/CRM/Contact/Form/Edit/Tagtree.tpl @@ -29,7 +29,7 @@
  • - + {if $node.children} {* Recurse... *} diff --git a/templates/CRM/Contact/Page/Inline/Actions.tpl b/templates/CRM/Contact/Page/Inline/Actions.tpl index d92432b9f9..9dbf7eecce 100644 --- a/templates/CRM/Contact/Page/Inline/Actions.tpl +++ b/templates/CRM/Contact/Page/Inline/Actions.tpl @@ -39,7 +39,7 @@ {foreach from=$actionsMenuList.otherActions item='row'} {if !empty($row.href) or !empty($row.tab)}
  • - + {$row.title}
    • @@ -52,7 +52,7 @@ {foreach from=$actionsMenuList.moreActions item='row'} {if !empty($row.href) or !empty($row.tab)}
  • - {$row.title} + {$row.title}
    • {/if} {/foreach} diff --git a/templates/CRM/Contact/Page/View/Summary.tpl b/templates/CRM/Contact/Page/View/Summary.tpl index 4b359d825c..2058cc512c 100644 --- a/templates/CRM/Contact/Page/View/Summary.tpl +++ b/templates/CRM/Contact/Page/View/Summary.tpl @@ -125,7 +125,7 @@