gnh1201/seeddms-code
1
0
Fork 0
mirror of https://git.code.sf.net/p/seeddms/code synced 2025-03-11 16:35:38 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

escape user names to prevent xss attacks

Browse Source
This commit is contained in:
Uwe Steinmann 2016-01-27 06:48:39 +01:00
parent a8b8da6cc8
commit 371bd08e38
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
views/bootstrap/class.SubstituteUser.php
View File

@ -50,17 +50,17 @@ class SeedDMS_View_SubstituteUser extends SeedDMS_Bootstrap_Style {
foreach ($allUsers as $currUser) {
echo "<tr>";
echo "<td>";
echo $currUser->getFullName()." (".$currUser->getLogin().")<br />";
echo "<small>".$currUser->getComment()."</small>";
echo htmlspecialchars($currUser->getFullName())." (".htmlspecialchars($currUser->getLogin()).")<br />";
echo "<small>".htmlspecialchars($currUser->getComment())."</small>";
echo "</td>";
echo "<td>";
echo "<a href=\"mailto:".$currUser->getEmail()."\">".$currUser->getEmail()."</a><br />";
echo "<a href=\"mailto:".htmlspecialchars($currUser->getEmail())."\">".htmlspecialchars($currUser->getEmail())."</a><br />";
echo "</td>";
echo "<td>";
$groups = $currUser->getGroups();
if (count($groups) != 0) {
for ($j = 0; $j < count($groups); $j++) {
print $groups[$j]->getName();
print htmlspecialchars($groups[$j]->getName());
if ($j +1 < count($groups))
print ", ";
}
@ -68,7 +68,7 @@ class SeedDMS_View_SubstituteUser extends SeedDMS_Bootstrap_Style {
echo "</td>";
echo "<td>";
if($currUser->getID() != $user->getID()) {
echo "<a class=\"btn\" href=\"../op/op.SubstituteUser.php?userid=".$currUser->getID()."\"><i class=\"icon-exchange\"></i> ".getMLText('substitute_user')."</a> ";
echo "<a class=\"btn\" href=\"../op/op.SubstituteUser.php?userid=".((int) $currUser->getID())."\"><i class=\"icon-exchange\"></i> ".getMLText('substitute_user')."</a> ";
}
echo "</td>";
echo "</tr>";