From 2b6b400e03d88916613c47ce603dd5ee218c0588 Mon Sep 17 00:00:00 2001
From: kink <kink@7612ce4b-ef26-0410-bec9-ea0150e637f0>
Date: Mon, 26 Apr 2004 23:02:06 +0000
Subject: [PATCH] Escape HTML output and add vim syntax hint.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@7267 7612ce4b-ef26-0410-bec9-ea0150e637f0
---
 plugins/squirrelspell/modules/check_me.mod      | 3 ++-
 plugins/squirrelspell/modules/crypto.mod        | 1 +
 plugins/squirrelspell/modules/crypto_badkey.mod | 1 +
 plugins/squirrelspell/modules/edit_dic.mod      | 4 +++-
 plugins/squirrelspell/modules/enc_setup.mod     | 1 +
 plugins/squirrelspell/modules/forget_me.mod     | 3 ++-
 plugins/squirrelspell/modules/forget_me_not.mod | 1 +
 plugins/squirrelspell/modules/init.mod          | 1 +
 plugins/squirrelspell/modules/lang_change.mod   | 1 +
 plugins/squirrelspell/modules/lang_setup.mod    | 1 +
 plugins/squirrelspell/modules/options_main.mod  | 1 +
 11 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/plugins/squirrelspell/modules/check_me.mod b/plugins/squirrelspell/modules/check_me.mod
index 66ff2606..ebc1dc1f 100644
--- a/plugins/squirrelspell/modules/check_me.mod
+++ b/plugins/squirrelspell/modules/check_me.mod
@@ -116,7 +116,7 @@ if ($sqspell_exitcode){
   $msg= "<div align='center'>"
      . sprintf(_("I tried to execute '%s', but it returned:"),
                $sqspell_command) . "<pre>"
-     . nl2br(join("\n", $sqspell_output)) . "</pre>"
+     . join("\n", htmlspecialchars($sqspell_output)) . "</pre>"
      . "<form onsubmit=\"return false\">"
      . "<input type=\"submit\" value=\"  " . _("Close")
      . "  \" onclick=\"self.close()\"></form></div>";
@@ -442,5 +442,6 @@ if ($errors){
  * Local variables:
  * mode: php
  * End:
+ * vim: syntax=php
  */
 ?>
diff --git a/plugins/squirrelspell/modules/crypto.mod b/plugins/squirrelspell/modules/crypto.mod
index cabd5c73..f06ab049 100644
--- a/plugins/squirrelspell/modules/crypto.mod
+++ b/plugins/squirrelspell/modules/crypto.mod
@@ -70,6 +70,7 @@ sqspell_makePage( _("Personal Dictionary Crypto Settings"), null, $msg);
  * Local variables:
  * mode: php
  * End:
+ * vim: syntax=php
  */
 
 ?>
diff --git a/plugins/squirrelspell/modules/crypto_badkey.mod b/plugins/squirrelspell/modules/crypto_badkey.mod
index 72203cc1..b817f531 100644
--- a/plugins/squirrelspell/modules/crypto_badkey.mod
+++ b/plugins/squirrelspell/modules/crypto_badkey.mod
@@ -92,5 +92,6 @@ if ($old_key){
  * Local variables:
  * mode: php
  * End:
+ * vim: syntax=php
  */    
 ?>
diff --git a/plugins/squirrelspell/modules/edit_dic.mod b/plugins/squirrelspell/modules/edit_dic.mod
index d96fe322..ffbad568 100644
--- a/plugins/squirrelspell/modules/edit_dic.mod
+++ b/plugins/squirrelspell/modules/edit_dic.mod
@@ -82,7 +82,8 @@ if (!$words){
 	  $msg .= "</td><td valign=\"top\">\n";
 	}
 	$msg .= "<input type=\"checkbox\" name=\"words_ary[]\" "
-	   . "value=\"$words_ary[$j]\"> $words_ary[$j]<br>";
+	   . 'value="'.htmlspecialchars($words_ary[$j]). '"> '
+           . htmlspecialchars($words_ary[$j]) . "<br>\n";
       }
       $msg .= '</td></tr></table></td></tr>'
 	 . "<tr bgcolor=\"$color[0]\" align=\"center\"><td>"
@@ -108,6 +109,7 @@ if (!$words){
  * Local variables:
  * mode: php
  * End:
+ * vim: syntax=php
  */
 
 ?>
diff --git a/plugins/squirrelspell/modules/enc_setup.mod b/plugins/squirrelspell/modules/enc_setup.mod
index cfdd783a..0feb3067 100644
--- a/plugins/squirrelspell/modules/enc_setup.mod
+++ b/plugins/squirrelspell/modules/enc_setup.mod
@@ -81,6 +81,7 @@ sqspell_makePage(_("Personal Dictionary Crypto Settings"),
  * Local variables:
  * mode: php
  * End:
+ * vim: syntax=php
  */ 
 
 ?>
diff --git a/plugins/squirrelspell/modules/forget_me.mod b/plugins/squirrelspell/modules/forget_me.mod
index 24a5421d..f33a69f1 100644
--- a/plugins/squirrelspell/modules/forget_me.mod
+++ b/plugins/squirrelspell/modules/forget_me.mod
@@ -37,7 +37,7 @@ if (sizeof($words_ary)){
      * Remove word by word...
      */
     $lang_words=str_replace("$words_ary[$i]\n", "", $lang_words);
-    $msg .= "<li>$words_ary[$i]</li>\n";
+    $msg .= '<li>' . htmlspecialchars($words_ary[$i]) . "</li>\n";
   }
   $new_words_ary=split("\n", $lang_words);
   /**
@@ -87,5 +87,6 @@ if (sizeof($words_ary)){
  * Local variables:
  * mode: php
  * End:
+ * vim: syntax=php
  */    
 ?>
diff --git a/plugins/squirrelspell/modules/forget_me_not.mod b/plugins/squirrelspell/modules/forget_me_not.mod
index b74b2fcb..cbfd5611 100644
--- a/plugins/squirrelspell/modules/forget_me_not.mod
+++ b/plugins/squirrelspell/modules/forget_me_not.mod
@@ -79,6 +79,7 @@ sqspell_makeWindow($onload, _("Personal Dictionary Updated"), null, $msg);
  * Local variables:
  * mode: php
  * End:
+ * vim: syntax=php
  */
 
 ?>
diff --git a/plugins/squirrelspell/modules/init.mod b/plugins/squirrelspell/modules/init.mod
index 0a44899f..4b8d3d8d 100644
--- a/plugins/squirrelspell/modules/init.mod
+++ b/plugins/squirrelspell/modules/init.mod
@@ -61,6 +61,7 @@ sqspell_makeWindow($onload, _("SquirrelSpell Initiating"), "init.js", $msg);
  * Local variables:
  * mode: php
  * End:
+ * vim: syntax=php
  */
     
 ?>
diff --git a/plugins/squirrelspell/modules/lang_change.mod b/plugins/squirrelspell/modules/lang_change.mod
index 8f180506..909b0441 100644
--- a/plugins/squirrelspell/modules/lang_change.mod
+++ b/plugins/squirrelspell/modules/lang_change.mod
@@ -99,5 +99,6 @@ sqspell_makePage(_("International Dictionaries Preferences Updated"),
  * Local variables:
  * mode: php
  * End:
+ * vim: syntax=php
  */
 ?>
diff --git a/plugins/squirrelspell/modules/lang_setup.mod b/plugins/squirrelspell/modules/lang_setup.mod
index 25013f8b..36c445d6 100644
--- a/plugins/squirrelspell/modules/lang_setup.mod
+++ b/plugins/squirrelspell/modules/lang_setup.mod
@@ -54,6 +54,7 @@ sqspell_makePage(_("Add International Dictionaries"), null, $msg);
  * Local variables:
  * mode: php
  * End:
+ * vim: syntax=php
  */
  
 ?>
diff --git a/plugins/squirrelspell/modules/options_main.mod b/plugins/squirrelspell/modules/options_main.mod
index ea58a26b..8ebe5193 100644
--- a/plugins/squirrelspell/modules/options_main.mod
+++ b/plugins/squirrelspell/modules/options_main.mod
@@ -52,5 +52,6 @@ sqspell_makePage( _("SquirrelSpell Options Menu"), null, $msg);
  * Local variables:
  * mode: php
  * End:
+ * vim: syntax=php
  */
 ?>
-- 
2.25.1