Skip to content

Commit 19acda6

Browse files
HackwarHackwar
authored
Merge branch '6.2-dev' into 6.2-exceptions-component3
2 parents b00fcd6 + f33620a commit 19acda6

103 files changed

Lines changed: 1410 additions & 873 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎administrator/components/com_categories/tmpl/category/modalreturn.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@
3737

3838
<div class="px-4 py-5 my-5 text-center">
3939
<span class="fa-8x mb-4 <?php echo $icon; ?>" aria-hidden="true"></span>
40-
<h1 class="display-5 fw-bold"><?php echo $title; ?></h1>
40+
<h1 class="display-5 fw-bold"><?php echo $this->escape($title); ?></h1>
4141
<div class="col-lg-6 mx-auto">
4242
<p class="lead mb-4">
4343
<?php echo $content; ?>

‎administrator/components/com_contact/tmpl/contact/modalreturn.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@
3838

3939
<div class="px-4 py-5 my-5 text-center">
4040
<span class="fa-8x mb-4 <?php echo $icon; ?>" aria-hidden="true"></span>
41-
<h1 class="display-5 fw-bold"><?php echo $title; ?></h1>
41+
<h1 class="display-5 fw-bold"><?php echo $this->escape($title); ?></h1>
4242
<div class="col-lg-6 mx-auto">
4343
<p class="lead mb-4">
4444
<?php echo $content; ?>

‎administrator/components/com_content/tmpl/article/modalreturn.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@
3838

3939
<div class="px-4 py-5 my-5 text-center">
4040
<span class="fa-8x mb-4 <?php echo $icon; ?>" aria-hidden="true"></span>
41-
<h1 class="display-5 fw-bold"><?php echo $title; ?></h1>
41+
<h1 class="display-5 fw-bold"><?php echo $this->escape($title); ?></h1>
4242
<div class="col-lg-6 mx-auto">
4343
<p class="lead mb-4">
4444
<?php echo $content; ?>

‎administrator/components/com_installer/tmpl/update/default.php‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -92,13 +92,13 @@
9292
<th scope="row">
9393
<span tabindex="0"><?php echo $this->escape($item->name); ?></span>
9494
<div role="tooltip" id="tip<?php echo $i; ?>">
95-
<?php echo $item->description; ?>
95+
<?php echo $this->escape($item->description); ?>
9696
</div>
9797
<div class="small break-word">
98-
<?php echo $item->detailsurl; ?>
98+
<?php echo $this->escape($item->detailsurl); ?>
9999
<?php if (!empty($item->infourl)) : ?>
100100
<br>
101-
<a href="<?php echo $item->infourl; ?>" target="_blank" rel="noopener noreferrer"><?php echo $this->escape(trim($item->infourl)); ?></a>
101+
<a href="<?php echo $this->escape($item->infourl); ?>" target="_blank" rel="noopener noreferrer"><?php echo $this->escape(trim($item->infourl)); ?></a>
102102
<?php endif; ?>
103103
</div>
104104
<?php if ($item->isMissingDownloadKey) : ?>
@@ -113,10 +113,10 @@
113113
<?php echo $item->type_translated; ?>
114114
</td>
115115
<td>
116-
<span class="badge bg-warning"><?php echo $item->current_version; ?></span>
116+
<span class="badge bg-warning"><?php echo $this->escape($item->current_version); ?></span>
117117
</td>
118118
<td>
119-
<span class="badge bg-success"><?php echo $item->version; ?></span>
119+
<span class="badge bg-success"><?php echo $this->escape($item->version); ?></span>
120120
</td>
121121
<td class="d-none d-md-table-cell text-center">
122122
<?php if (!empty($item->changelogurl)) :

‎administrator/components/com_languages/forms/override.xml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
<?xml version="1.0" encoding="UTF-8"?>
2-
<form>
2+
<form
3+
addruleprefix="Joomla\Component\Languages\Administrator\Rule"
4+
>
35
<fieldset>
46
<field
57
name="key"
@@ -15,6 +17,7 @@
1517
label="COM_LANGUAGES_OVERRIDE_FIELD_OVERRIDE_LABEL"
1618
cols="50"
1719
rows="5"
20+
validate="DisallowQuotes"
1821
filter="\Joomla\Component\Languages\Administrator\Helper\LanguagesHelper::filterText"
1922
/>
2023

‎administrator/components/com_languages/src/Rule/DisallowQuotesRule.php‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
<?php
2+
3+
/**
4+
* @package Joomla.Administrator
5+
* @subpackage com_languages
6+
*
7+
* @copyright (C) 2021 Open Source Matters, Inc. <https://www.joomla.org>
8+
* @license GNU General Public License version 2 or later; see LICENSE.txt
9+
*/
10+
11+
namespace Joomla\Component\Languages\Administrator\Rule;
12+
13+
use Joomla\CMS\Factory;
14+
use Joomla\CMS\Form\Form;
15+
use Joomla\CMS\Form\FormRule;
16+
use Joomla\CMS\Language\Text;
17+
use Joomla\Registry\Registry;
18+
19+
// phpcs:disable PSR1.Files.SideEffects
20+
\defined('_JEXEC') or die;
21+
// phpcs:enable PSR1.Files.SideEffects
22+
23+
/**
24+
* The DisallowQuotesRule Class.
25+
* Validates that non-superadmins can not use quotes or doublequotes in i18n overrides
26+
*
27+
* @since joomla 6.1.2
28+
*/
29+
class DisallowQuotesRule extends FormRule
30+
{
31+
/**
32+
* @param \SimpleXMLElement $element The SimpleXMLElement object representing the `<field>` tag for the form
33+
* field object.
34+
* @param mixed $value The form field value to validate.
35+
* @param ?string $group The field name group control value. This acts as an array container for the
36+
* field. For example if the field has `name="foo"` and the group value is set
37+
* to "bar" then the full field name would end up being "bar[foo]".
38+
* @param ?Registry $input An optional Registry object with the entire data set to validate against
39+
* the entire form.
40+
* @param ?Form $form The form object for which the field is being tested.
41+
*
42+
* @return boolean
43+
*
44+
* @since 4.1.0
45+
*/
46+
public function test(\SimpleXMLElement $element, $value, $group = null, ?Registry $input = null, ?Form $form = null): bool
47+
{
48+
// User with core.admin can use quotes
49+
if (Factory::getApplication()->getIdentity()->authorise('core.admin')) {
50+
return true;
51+
}
52+
53+
// Disallow double and single quotes in overrides
54+
if (str_contains($value, '"') || str_contains($value, '\'')) {
55+
Factory::getApplication()->enqueueMessage(
56+
Text::_('COM_LANGUAGES_ERROR_QUOTES_IN_TEXT'),
57+
'error'
58+
);
59+
60+
return false;
61+
}
62+
63+
return true;
64+
}
65+
}

‎administrator/components/com_menus/tmpl/item/modalreturn.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@
3535

3636
<div class="px-4 py-5 my-5 text-center">
3737
<span class="fa-8x mb-4 <?php echo $icon; ?>" aria-hidden="true"></span>
38-
<h1 class="display-5 fw-bold"><?php echo $title; ?></h1>
38+
<h1 class="display-5 fw-bold"><?php echo $this->escape($title); ?></h1>
3939
<div class="col-lg-6 mx-auto">
4040
<p class="lead mb-4">
4141
<?php echo $content; ?>

‎administrator/components/com_modules/tmpl/module/modalreturn.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@
4242

4343
<div class="px-4 py-5 my-5 text-center">
4444
<span class="fa-8x mb-4 <?php echo $icon; ?>" aria-hidden="true"></span>
45-
<h1 class="display-5 fw-bold"><?php echo $title; ?></h1>
45+
<h1 class="display-5 fw-bold"><?php echo $this->escape($title); ?></h1>
4646
<div class="col-lg-6 mx-auto">
4747
<p class="lead mb-4">
4848
<?php echo $content; ?>

‎administrator/components/com_newsfeeds/tmpl/newsfeed/modalreturn.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@
3838

3939
<div class="px-4 py-5 my-5 text-center">
4040
<span class="fa-8x mb-4 <?php echo $icon; ?>" aria-hidden="true"></span>
41-
<h1 class="display-5 fw-bold"><?php echo $title; ?></h1>
41+
<h1 class="display-5 fw-bold"><?php echo $this->escape($title); ?></h1>
4242
<div class="col-lg-6 mx-auto">
4343
<p class="lead mb-4">
4444
<?php echo $content; ?>

‎administrator/components/com_plugins/tmpl/plugin/modalreturn.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@
3838

3939
<div class="px-4 py-5 my-5 text-center">
4040
<span class="fa-8x mb-4 <?php echo $icon; ?>" aria-hidden="true"></span>
41-
<h1 class="display-5 fw-bold"><?php echo $title; ?></h1>
41+
<h1 class="display-5 fw-bold"><?php echo $this->escape($title); ?></h1>
4242
<div class="col-lg-6 mx-auto">
4343
<p class="lead mb-4">
4444
<?php echo $content; ?>

0 commit comments

Comments
 (0)