Created
April 23, 2013 22:53
-
-
Save rjmackay/5448126 to your computer and use it in GitHub Desktop.
Theme changes for security fix 2013-001
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| diff --git a/themes/default/css/style.css b/themes/default/css/style.css | |
| index f0ff34f..bb97676 100644 | |
| --- a/themes/default/css/style.css | |
| +++ b/themes/default/css/style.css | |
| @@ -2126,3 +2126,10 @@ div.ci_checkin { | |
| .user-color { width:160px;height:20px; } | |
| .badges { float:left;padding-left:25px;width:275px;} | |
| .badge img { margin:5px; } | |
| + | |
| +.allowed-html { | |
| + font-weight: normal; | |
| + font-size: 10px; | |
| + line-height: 12px; | |
| + color: #a1a1a1; | |
| +} | |
| diff --git a/themes/default/views/blocks/main_reports.php b/themes/default/views/blocks/main_reports.php | |
| index a1895ae..c9ba452 100644 | |
| --- a/themes/default/views/blocks/main_reports.php | |
| +++ b/themes/default/views/blocks/main_reports.php | |
| @@ -19,14 +19,14 @@ | |
| foreach ($incidents as $incident) | |
| { | |
| $incident_id = $incident->id; | |
| - $incident_title = text::limit_chars(strip_tags($incident->incident_title), 40, '...', True); | |
| + $incident_title = text::limit_chars(html::escape($incident->incident_title), 40, '...', True); | |
| $incident_date = $incident->incident_date; | |
| $incident_date = date('M j Y', strtotime($incident->incident_date)); | |
| $incident_location = $incident->location->location_name; | |
| ?> | |
| <tr> | |
| - <td><a href="<?php echo url::site() . 'reports/view/' . $incident_id; ?>"> <?php echo html::specialchars($incident_title) ?></a></td> | |
| - <td><?php echo html::specialchars($incident_location) ?></td> | |
| + <td><a href="<?php echo url::site() . 'reports/view/' . $incident_id; ?>"> <?php echo html::escape($incident_title) ?></a></td> | |
| + <td><?php echo html::escape($incident_location) ?></td> | |
| <td><?php echo $incident_date; ?></td> | |
| </tr> | |
| <?php | |
| diff --git a/themes/default/views/feed/atom.php b/themes/default/views/feed/atom.php | |
| index ad0882b..f9ab59f 100644 | |
| --- a/themes/default/views/feed/atom.php | |
| +++ b/themes/default/views/feed/atom.php | |
| @@ -1,7 +1,7 @@ | |
| -<?php echo "<?xml version=\"1.0\"?>"; ?> | |
| +<?php echo "<?xml version=\"1.0\" encoding=\"utf-8\" ?>"; ?> | |
| <feed xmlns="http://www.w3.org/2005/Atom"<?php if(isset($georss)) echo ' xmlns:georss="http://www.georss.org/georss"';?>> | |
| - <title type="text"><?php echo $feed_title; ?></title> | |
| - <subtitle type="html"><?php echo $feed_description; ?></subtitle> | |
| + <title type="text"><?php echo html::specialchars($feed_title); ?></title> | |
| + <subtitle type="html"><?php echo html::specialchars($feed_description); ?></subtitle> | |
| <updated><?php echo gmdate("c", strtotime($feed_date)); ?></updated> | |
| <id><?php echo $feed_url; ?></id> | |
| <link rel="alternate" type="text/html" href="<?php echo $site_url; ?>"/> | |
| @@ -15,14 +15,14 @@ | |
| foreach ($items as $item) | |
| {?> | |
| <entry> | |
| - <title><?php echo $item['title']; ?></title> | |
| + <title><?php echo html::specialchars($item['title']); ?></title> | |
| <link rel="alternate" type="text/html" href="<?php echo $item['link']; ?>"/> | |
| <updated><?php echo gmdate("c", strtotime($item['date'])); ?></updated> | |
| <published><?php echo gmdate("c", strtotime($item['date'])); ?></published> | |
| <content type="xhtml" xml:lang="en" | |
| xml:base="http://diveintomark.org/"> | |
| <div xmlns="http://www.w3.org/1999/xhtml"> | |
| - <?php echo $item['description']; ?> | |
| + <?php echo html::clean($item['description']); ?> | |
| </div> | |
| </content> | |
| <?php | |
| diff --git a/themes/default/views/feed/rss2.php b/themes/default/views/feed/rss2.php | |
| index dc11705..01de2e0 100644 | |
| --- a/themes/default/views/feed/rss2.php | |
| +++ b/themes/default/views/feed/rss2.php | |
| @@ -1,10 +1,10 @@ | |
| -<?php echo "<?xml version=\"1.0\"?>"; ?> | |
| +<?php echo "<?xml version=\"1.0\" encoding=\"utf-8\" ?>"; ?> | |
| <rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"<?php if(isset($georss)) echo ' xmlns:georss="http://www.georss.org/georss"';?>> | |
| <channel> | |
| - <title><?php echo $feed_title; ?></title> | |
| + <title><?php echo html::specialchars($feed_title); ?></title> | |
| <link><?php echo $site_url; ?></link> | |
| <pubDate><?php echo gmdate("D, d M Y H:i:s T", strtotime($feed_date)); ?></pubDate> | |
| - <description><?php echo $feed_description; ?></description> | |
| + <description><?php echo html::specialchars($feed_description); ?></description> | |
| <generator>Ushahidi Platform</generator> | |
| <atom:link href="<?php echo $feed_url; ?>" rel="self" type="application/rss+xml" /> | |
| @@ -13,9 +13,9 @@ | |
| <?php foreach ($items as $item): ?> | |
| <item> | |
| - <title><?php echo htmlspecialchars($item['title']); ?></title> | |
| + <title><?php echo html::specialchars($item['title']); ?></title> | |
| <link><?php echo $item['link']; ?></link> | |
| - <description><![CDATA[<?php echo htmlspecialchars($item['description'], ENT_COMPAT, 'UTF-8'); ?>]]></description> | |
| + <description><![CDATA[<?php echo html::specialchars($item['description']); ?>]]></description> | |
| <pubDate><?php echo gmdate("D, d M Y H:i:s T", strtotime($item['date'])); ?></pubDate> | |
| <guid><?php if(isset($item['guid'])) echo $item['guid']; else echo $item['link'] ?></guid> | |
| @@ -24,7 +24,7 @@ | |
| <?php endif; ?> | |
| <?php foreach ($item['categories'] as $category): ?> | |
| - <category><?php echo htmlspecialchars($category); ?></category> | |
| + <category><?php echo html::specialchars($category); ?></category> | |
| <?php endforeach; ?> | |
| <?php // Event::feed_rss_item - Add to the feed item ?> | |
| diff --git a/themes/default/views/header.php b/themes/default/views/header.php | |
| index 53e19ad..2e9c472 100644 | |
| --- a/themes/default/views/header.php | |
| +++ b/themes/default/views/header.php | |
| @@ -89,7 +89,7 @@ | |
| </ul> | |
| <?php if ($allow_feed == 1) { ?> | |
| - <div class="feedicon"><a href="<?php echo url::site(); ?>feed/"><img alt="<?php echo htmlentities(Kohana::lang('ui_main.rss'), ENT_QUOTES); ?>" src="<?php echo url::file_loc('img'); ?>media/img/icon-feed.png" style="vertical-align: middle;" border="0" /></a></div> | |
| + <div class="feedicon"><a href="<?php echo url::site(); ?>feed/"><img alt="<?php echo html::escape(Kohana::lang('ui_main.rss')); ?>" src="<?php echo url::file_loc('img'); ?>media/img/icon-feed.png" style="vertical-align: middle;" border="0" /></a></div> | |
| <?php } ?> | |
| </div> | |
| diff --git a/themes/default/views/main/layout.php b/themes/default/views/main/layout.php | |
| index bbc2a58..8147328 100755 | |
| --- a/themes/default/views/main/layout.php | |
| +++ b/themes/default/views/main/layout.php | |
| @@ -49,12 +49,12 @@ | |
| <?php | |
| foreach ($categories as $category => $category_info) | |
| { | |
| - $category_title = htmlentities($category_info[0], ENT_QUOTES, "UTF-8"); | |
| + $category_title = html::escape($category_info[0]); | |
| $category_color = $category_info[1]; | |
| $category_image = ($category_info[2] != NULL) | |
| ? url::convert_uploaded_to_abs($category_info[2]) | |
| : NULL; | |
| - $category_description = htmlentities(Category_Lang_Model::category_description($category), ENT_QUOTES, "UTF-8"); | |
| + $category_description = html::escape(Category_Lang_Model::category_description($category)); | |
| $color_css = 'class="category-icon swatch" style="background-color:#'.$category_color.'"'; | |
| if ($category_info[2] != NULL) | |
| @@ -78,12 +78,12 @@ | |
| echo '<ul>'; | |
| foreach ($category_info[3] as $child => $child_info) | |
| { | |
| - $child_title = htmlentities($child_info[0], ENT_QUOTES, "UTF-8"); | |
| + $child_title = html::escape($child_info[0]); | |
| $child_color = $child_info[1]; | |
| $child_image = ($child_info[2] != NULL) | |
| ? url::convert_uploaded_to_abs($child_info[2]) | |
| : NULL; | |
| - $child_description = htmlentities(Category_Lang_Model::category_description($child), ENT_QUOTES, "UTF-8"); | |
| + $child_description = html::escape(Category_Lang_Model::category_description($child)); | |
| $color_css = 'class="category-icon swatch" style="background-color:#'.$child_color.'"'; | |
| if ($child_info[2] != NULL) | |
| diff --git a/themes/default/views/page.php b/themes/default/views/page.php | |
| index f474e0d..c78d642 100644 | |
| --- a/themes/default/views/page.php | |
| +++ b/themes/default/views/page.php | |
| @@ -1,9 +1,9 @@ | |
| <div id="content"> | |
| <div class="content-bg"> | |
| <div class="big-block"> | |
| - <h1><?php echo $page_title ?></h1> | |
| + <h1><?php echo html::escape($page_title) ?></h1> | |
| <div class="page_text"><?php | |
| - echo htmlspecialchars_decode($page_description); | |
| + echo $page_description; | |
| Event::run('ushahidi_action.page_extra', $page_id); | |
| ?></div> | |
| </div> | |
| diff --git a/themes/default/views/profile/user.php b/themes/default/views/profile/user.php | |
| index adeadba..b1df0ce 100644 | |
| --- a/themes/default/views/profile/user.php | |
| +++ b/themes/default/views/profile/user.php | |
| @@ -24,7 +24,7 @@ | |
| <h4><?php echo Kohana::lang('ui_main.reports_by_this_user');?></h4> | |
| <?php foreach($reports as $report) { ?> | |
| <div class="rb_report"> | |
| - <h5><a href="<?php echo url::site(); ?>reports/view/<?php echo $report->id; ?>"><?php echo strip_tags($report->incident_title); ?></a></h5> | |
| + <h5><a href="<?php echo url::site(); ?>reports/view/<?php echo $report->id; ?>"><?php echo html::escape($report->incident_title); ?></a></h5> | |
| <p class="r_date r-3 bottom-cap"><?php echo date('H:i M d, Y', strtotime($report->incident_date)); ?></p> | |
| <p class="r_location"><?php echo html::specialchars($report->location->location_name); ?></p> | |
| </div> | |
| diff --git a/themes/default/views/reports/comments.php b/themes/default/views/reports/comments.php | |
| index 07980b6..5d9a0ca 100644 | |
| --- a/themes/default/views/reports/comments.php | |
| +++ b/themes/default/views/reports/comments.php | |
| @@ -8,10 +8,10 @@ | |
| <div class="report-comment-box"> | |
| <div> | |
| - <strong><?php echo html::specialchars($comment->comment_author); ?></strong> (<?php echo date('M j Y', strtotime($comment->comment_date)); ?>) | |
| + <strong><?php echo html::strip_tags($comment->comment_author); ?></strong> (<?php echo date('M j Y', strtotime($comment->comment_date)); ?>) | |
| </div> | |
| - <div><?php echo html::specialchars($comment->comment_description); ?></div> | |
| + <div><?php echo html::escape($comment->comment_description); ?></div> | |
| </div> | |
| <?php endforeach; ?> | |
| diff --git a/themes/default/views/reports/detail.php b/themes/default/views/reports/detail.php | |
| index 0145e07..462ebe6 100755 | |
| --- a/themes/default/views/reports/detail.php | |
| +++ b/themes/default/views/reports/detail.php | |
| @@ -14,7 +14,7 @@ | |
| ?> | |
| <h1 class="report-title"><?php | |
| - echo htmlentities($incident_title, ENT_QUOTES, "UTF-8"); | |
| + echo html::escape($incident_title); | |
| // If Admin is Logged In - Allow For Edit Link | |
| if ($logged_in) | |
| @@ -78,7 +78,7 @@ | |
| echo '<div id="report-images">'; | |
| foreach ($incident_photos as $photo) | |
| { | |
| - echo '<a class="photothumb" rel="lightbox-group1" href="'.$photo['large'].'"><img alt="'.htmlentities($incident_title, ENT_QUOTES, "UTF-8").'" src="'.$photo['thumb'].'"/></a> '; | |
| + echo '<a class="photothumb" rel="lightbox-group1" href="'.$photo['large'].'"><img alt="'.html::escape($incident_title).'" src="'.$photo['thumb'].'"/></a> '; | |
| }; | |
| echo '</div>'; | |
| } | |
| @@ -103,7 +103,7 @@ | |
| <!-- start report description --> | |
| <div class="report-description-text"> | |
| <h5><?php echo Kohana::lang('ui_main.reports_description');?></h5> | |
| - <?php echo nl2br($incident_description); ?> | |
| + <?php echo html::clean(nl2br($incident_description)); ?> | |
| <br/> | |
| diff --git a/themes/default/views/reports/list.php b/themes/default/views/reports/list.php | |
| index abdd731..2ee0f25 100644 | |
| --- a/themes/default/views/reports/list.php | |
| +++ b/themes/default/views/reports/list.php | |
| @@ -44,14 +44,14 @@ | |
| foreach ($incidents as $incident) | |
| { | |
| $incident_id = $incident->incident_id; | |
| - $incident_title = strip_tags($incident->incident_title); | |
| - $incident_description = strip_tags($incident->incident_description); | |
| + $incident_title = html::strip_tags($incident->incident_title); | |
| + $incident_description = html::strip_tags($incident->incident_description); | |
| $incident_url = Incident_Model::get_url($incident_id); | |
| //$incident_category = $incident->incident_category; | |
| // Trim to 150 characters without cutting words | |
| // XXX: Perhaps delcare 150 as constant | |
| - $incident_description = text::limit_chars(strip_tags($incident_description), 140, "...", true); | |
| + $incident_description = text::limit_chars(html::strip_tags($incident_description), 140, "...", true); | |
| $incident_date = date('H:i M d, Y', strtotime($incident->incident_date)); | |
| //$incident_time = date('H:i', strtotime($incident->incident_date)); | |
| $location_id = $incident->location_id; | |
| @@ -88,7 +88,7 @@ | |
| <div id="incident_<?php echo $incident_id ?>" class="rb_report <?php echo $incident_verified_class; ?>"> | |
| <div class="r_media"> | |
| <p class="r_photo"> <a href="<?php echo $incident_url; ?>"> | |
| - <img alt="<?php echo htmlentities($incident_title, ENT_QUOTES, "UTF-8"); ?>" src="<?php echo $incident_thumb; ?>" /> </a> | |
| + <img alt="<?php echo html::escape($incident_title); ?>" src="<?php echo $incident_thumb; ?>" /> </a> | |
| </p> | |
| <!-- Only show this if the report has a video --> | |
| @@ -126,7 +126,7 @@ | |
| <div class="r_details"> | |
| <h3><a class="r_title" href="<?php echo $incident_url; ?>"> | |
| - <?php echo htmlentities($incident_title, ENT_QUOTES, "UTF-8"); ?> | |
| + <?php echo html::escape($incident_title); ?> | |
| </a> | |
| <a href="<?php echo "$incident_url#discussion"; ?>" class="r_comments"> | |
| <?php echo $comment_count; ?></a> | |
| diff --git a/themes/default/views/reports/submit.php b/themes/default/views/reports/submit.php | |
| index be16ec8..3656923 100755 | |
| --- a/themes/default/views/reports/submit.php | |
| +++ b/themes/default/views/reports/submit.php | |
| @@ -50,6 +50,7 @@ | |
| </div> | |
| <div class="report_row"> | |
| <h4><?php echo Kohana::lang('ui_main.reports_description'); ?> <span class="required">*</span> </h4> | |
| + <span class="allowed-html"><?php echo html::allowed_html(); ?></span> | |
| <?php print form::textarea('incident_description', $form['incident_description'], ' rows="10" class="textarea long" ') ?> | |
| </div> | |
| <div class="report_row" id="datetime_default"> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment