global $color;
$td_str = '<INPUT NAME="' . $name . '[' . $field . ']" SIZE="' . $size . '" VALUE="';
if (isset($values[$field])) {
- $td_str .= htmlspecialchars($values[$field]);
+ $td_str .= htmlspecialchars( strip_tags( $values[$field] ) );
}
$td_str .= '">' . $add . '';
return html_tag( 'tr' ,
/* Output form to add and modify address data */
function address_form($name, $submittext, $values = array()) {
global $color;
+
echo html_tag( 'table',
adressbook_inp_field(_("Nickname"), 'nickname', $name, 15, $values,
- '<SMALL>' . _("Must be unique") . '</SMALL>') .
+ ' <SMALL>' . _("Must be unique") . '</SMALL>') .
adressbook_inp_field(_("E-mail address"), 'email', $name, 45, $values, '') .
adressbook_inp_field(_("First name"), 'firstname', $name, 45, $values, '') .
adressbook_inp_field(_("Last name"), 'lastname', $name, 45, $values, '') .
$submittext . '">',
'center', $color[4], 'colspan="2"')
)
- , 'center', '', 'border="0" cellpadding="1" cols="2" width="90%"') ."\n";
+ , 'center', '', 'border="0" cellpadding="1" width="90%"') ."\n";
}
-
/* Open addressbook, with error messages on but without LDAP (the *
* second "true"). Don't need LDAP here anyway */
$abook = addressbook_init(true, true);
displayPageHeader($color, 'None');
-
$defdata = array();
$formerror = '';
$abortform = false;
$showaddrlist = true;
$defselected = array();
+$form_url = 'addressbook.php';
/* Handle user's actions */
* Add new address *
**************************************************/
if (!empty($addaddr['nickname'])) {
-
+ foreach( $addaddr as $k => $adr ) {
+ $addaddr[$k] = strip_tags( $adr );
+ }
$r = $abook->add($addaddr, $abook->localbackend);
/* Handle error messages */
$showaddrlist = false;
$defdata = $addaddr;
}
-
} else {
/************************************************
$olddata = $abook->lookup($enick, $ebackend);
/* Display the "new address" form */
- echo '<FORM ACTION="' . $PHP_SELF . '" METHOD="POST">' .
+ echo '<FORM ACTION="' . $form_url . '" METHOD="POST">' .
"\n" .
html_tag( 'table',
html_tag( 'tr',
"\n". '<strong>' . _("Update address") . '</strong>' ."\n",
'center', $color[0] )
),
- 'center', '', 'width="100%" cols="1"' ) .
+ 'center', '', 'width="100%" ' );
address_form("editaddr", _("Update address"), $olddata);
echo '<INPUT TYPE=hidden NAME=oldnick VALUE="' .
htmlspecialchars($olddata["nickname"]) . "\">\n" .
'">' . _("ERROR") . ': ' . $abook->error . '</font></strong>' ."\n",
'center' )
),
- 'center', '', 'width="100%" cols="1"' );
+ 'center', '', 'width="100%"' );
/* Display the "new address" form again */
- echo '<FORM ACTION="' . $PHP_SELF .
+ echo '<FORM ACTION="' . $form_url .
'" METHOD="POST">' . "\n" .
html_tag( 'table',
html_tag( 'tr',
"\n". '<br><strong>' . _("Update address") . '</strong>' ."\n",
'center', $color[0] )
),
- 'center', '', 'width="100%" cols="1"' ) .
+ 'center', '', 'width="100%"' ) .
address_form("editaddr", _("Update address"), $newdata);
echo '<INPUT TYPE=hidden NAME=oldnick VALUE="' .
htmlspecialchars($oldnick) . "\">\n" .
'">' . _("ERROR") . ': ' . $formerror . '</font></strong>' ."\n",
'center' )
),
- 'center', '', 'width="100%" cols="1"' );
+ 'center', '', 'width="100%"' );
}
/* List addresses */
if (count($alist) > 0) {
- echo '<FORM ACTION="' . $PHP_SELF . '" METHOD="POST">' . "\n";
+ echo '<FORM ACTION="' . $form_url . '" METHOD="POST">' . "\n";
while(list($undef,$row) = each($alist)) {
/* New table header for each backend */
html_tag( 'tr',
html_tag( 'td', "\n" . '<strong>' . $row['source'] . '</strong>' . "\n", 'center', $color[0] )
) ,
- 'center', '', 'width="95%" cols="1"' ) ."\n"
- . html_tag( 'table', '', 'center', '', 'cols="5" border="0" cellpadding="1" cellspacing="0" width="90%"' ) .
+ 'center', '', 'width="95%"' ) ."\n"
+ . html_tag( 'table', '', 'center', '', 'border="0" cellpadding="1" cellspacing="0" width="90%"' ) .
html_tag( 'tr', "\n" .
html_tag( 'th', ' ', 'left', '', 'width="1%"' ) .
html_tag( 'th', _("Nickname"), 'left', '', 'width="1%"' ) .
/* Display the "new address" form */
echo '<a name="AddAddress"></a>' . "\n" .
- '<FORM ACTION="' . $PHP_SELF . '" NAME=f_add METHOD="POST">' . "\n" .
- html_tag( 'table',
+ '<FORM ACTION="' . $form_url . '" NAME=f_add METHOD="POST">' . "\n" .
+ html_tag( 'table',
html_tag( 'tr',
html_tag( 'td', "\n". '<strong>' . sprintf(_("Add to %s"), $abook->localbackendname) . '</strong>' . "\n",
'center', $color[0]
)
)
- , 'center', '', 'width="100%" cols="1"' ) ."\n";
+ , 'center', '', 'width="100%"' ) ."\n";
address_form('addaddr', _("Add address"), $defdata);
echo '</FORM>';
do_hook('addressbook_bottom');
?>
-</BODY></HTML>
+</BODY></HTML>
\ No newline at end of file