tyler.durden
/
icingaweb2
mirror of https://github.com/Icinga/icingaweb2.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Do not use htmlspecialchars in widgets 

refs #6759
This commit is contained in:
Alexander Klimov 2014-07-23 12:12:05 +02:00
parent cb27a3d0f1
commit 2ff43abcf5
4 changed files with 11 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
library/Icinga/Web/Widget/AbstractWidget.php
View File

@ -118,7 +118,7 @@ abstract class AbstractWidget
try {
$html = $this->render($this->view());
} catch (Exception $e) {
return htmlspecialchars($e->getMessage());
return $this->escape($e->getMessage());
}
return (string) $html;
}

2
library/Icinga/Web/Widget/AlertMessageBox.php
View File

@ -124,7 +124,7 @@ class AlertMessageBox extends AbstractWidget
$alert = $this->states[$level];
$html .= '<div class="alert ' . $alert['state']. '">' .
$this->view()->icon($alert['icon']) .
'<strong>' . htmlspecialchars($message->getMessage()) . '</strong>' .
'<strong>' . $this->escape($message->getMessage()) . '</strong>' .
'</div>';
}
return $html;

16
library/Icinga/Web/Widget/Chart/InlinePie.php
View File

@ -24,7 +24,7 @@ class InlinePie extends AbstractWidget
const NUMBER_FORMAT_TIME = 'time';
const NUMBER_FORMAT_BYTES = 'bytes';
const NUMBER_FORMAT_RATIO = 'ratio';
/**
* The template string used for rendering this widget
* The template string used for rendering this widget
@ -137,7 +137,7 @@ EOD;
* @var string
*/
private $tooltipFormat = '<b>{{title}}</b></br> {{label}}: {{formatted}} ({{percent}}%)';
/**
* The number format used to render numeric values in tooltips
*
@ -212,7 +212,7 @@ EOD;
{
$this->format = $format;
}
/**
* A format string used to render the content of the piechart tooltips
*
@ -346,11 +346,11 @@ EOD;
{
$template = $this->template;
$template = str_replace('{url}', $this->url, $template);
// style
$template = str_replace('{width}', $this->width, $template);
$template = str_replace('{height}', $this->height, $template);
$template = str_replace('{title}', htmlspecialchars($this->title), $template);
$template = str_replace('{title}', $this->escape($this->title), $template);
$template = str_replace('{style}', $this->style, $template);
$template = str_replace('{colors}', implode(',', $this->colors), $template);
$template = str_replace('{borderWidth}', $this->borderWidth, $template);
@ -370,9 +370,9 @@ EOD;
foreach ($this->data as $key => $value) {
$formatted[$key] = $this->formatValue($value);
}
$template = str_replace('{data}', htmlspecialchars(implode(',', $data)), $template);
$template = str_replace('{formatted}', htmlspecialchars(implode('|', $formatted)), $template);
$template = str_replace('{labels}', htmlspecialchars($this->createLabelString()), $template);
$template = str_replace('{data}', $this->escape(implode(',', $data)), $template);
$template = str_replace('{formatted}', $this->escape(implode('|', $formatted)), $template);
$template = str_replace('{labels}', $this->escape($this->createLabelString()), $template);
$template = str_replace('{tooltipFormat}', $this->tooltipFormat, $template);
return $template;
}

2
library/Icinga/Web/Widget/Tabs.php
View File

@ -259,7 +259,7 @@ EOT;
try {
$html = $this->render(Icinga::app()->getViewRenderer()->view);
} catch (Exception $e) {
return htmlspecialchars($e->getMessage());
return $this->escape($e->getMessage());
}
return $html;
}