diff options
| -rw-r--r-- | ancestry.php | 5 | ||||
| -rw-r--r-- | compact.php | 6 | ||||
| -rw-r--r-- | includes/classes/class_treenav.php | 6 | ||||
| -rw-r--r-- | includes/controllers/individual_ctrl.php | 4 | ||||
| -rw-r--r-- | includes/controllers/search_ctrl.php | 2 | ||||
| -rw-r--r-- | includes/functions/functions.php | 14 | ||||
| -rw-r--r-- | includes/functions/functions_edit.php | 10 | ||||
| -rw-r--r-- | includes/functions/functions_mediadb.php | 6 | ||||
| -rw-r--r-- | includes/functions/functions_print.php | 7 | ||||
| -rw-r--r-- | includes/functions/functions_print_facts.php | 20 | ||||
| -rw-r--r-- | includes/functions/functions_print_lists.php | 2 | ||||
| -rw-r--r-- | login.php | 17 | ||||
| -rw-r--r-- | media.php | 5 | ||||
| -rw-r--r-- | medialist.php | 4 | ||||
| -rw-r--r-- | mediaviewer.php | 5 | ||||
| -rw-r--r-- | modules/lightbox/functions/lightbox_print_media_row.php | 3 | ||||
| -rw-r--r-- | modules/user_messages/module.php | 7 | ||||
| -rw-r--r-- | timeline.php | 4 |
18 files changed, 63 insertions, 64 deletions
diff --git a/ancestry.php b/ancestry.php index 6e76973990..d5436d9d7e 100644 --- a/ancestry.php +++ b/ancestry.php @@ -79,13 +79,13 @@ echo WT_JS_START, 'var pastefield; function paste_id(value) {pastefield.value=va <tr> <td class="descriptionbox"><?php echo i18n::translate('Root Person ID'), help_link('rootid'); ?></td> <td class="optionbox"> -<input class="pedigree_form" type="text" name="rootid" id="rootid" size="3" value="<?php echo htmlentities($controller->rootid, ENT_COMPAT, 'UTF-8'); ?>" /> +<input class="pedigree_form" type="text" name="rootid" id="rootid" size="3" value="<?php echo htmlspecialchars($controller->rootid); ?>" /> <?php print_findindi_link("rootid", ""); ?> </td> <!-- // NOTE: Box width --> <td class="descriptionbox"><?php echo i18n::translate('Box width'), help_link('box_width'); ?></td> -<td class="optionbox"><input type="text" size="3" name="box_width" value="<?php echo htmlentities($box_width, ENT_COMPAT, 'UTF-8'); ?>" /> <b>%</b> +<td class="optionbox"><input type="text" size="3" name="box_width" value="<?php echo htmlspecialchars($box_width); ?>" /> <b>%</b> </td> <!-- // NOTE: chart style --> @@ -253,4 +253,3 @@ case 3: break; } print_footer(); -?> diff --git a/compact.php b/compact.php index f7f6c221f3..85735ae97f 100644 --- a/compact.php +++ b/compact.php @@ -318,13 +318,13 @@ function print_td_person($n) { $imgwidth = $imgsize[0]+50; $imgheight = $imgsize[1]+150; if (WT_USE_LIGHTBOX) { - $text .= "<a href=\"" . $object["file"] . "\" rel=\"clearbox[general]\" rev=\"" . $object['mid'] . "::" . WT_GEDCOM . "::" . PrintReady(htmlspecialchars($name,ENT_QUOTES,'UTF-8')) . "\">" . "\n"; + $text .= "<a href=\"" . $object["file"] . "\" rel=\"clearbox[general]\" rev=\"" . $object['mid'] . "::" . WT_GEDCOM . "::" . PrintReady(htmlspecialchars($name)) . "\">" . "\n"; } else { $text .= "<a href=\"javascript:;\" onclick=\"return openImage('".rawurlencode($object["file"])."',$imgwidth, $imgheight);\">"; } $birth_date=$indi->getBirthDate(); $death_date=$indi->getDeathDate(); - $text .= "<img id=\"box-$pid\" src=\"".$whichFile."\"vspace=\"0\" hspace=\"0\" class=\"$class\" alt =\"\" title=\"".PrintReady(htmlspecialchars(strip_tags($name), ENT_QUOTES, 'UTF-8'))." - ".strip_tags(html_entity_decode($birth_date->Display(false)." - ".$death_date->Display(false),ENT_QUOTES,'UTF-8'))."\""; + $text .= "<img id=\"box-$pid\" src=\"".$whichFile."\"vspace=\"0\" hspace=\"0\" class=\"$class\" alt =\"\" title=\"".PrintReady(htmlspecialchars(strip_tags($name)))." - ".strip_tags(html_entity_decode($birth_date->Display(false)." - ".$death_date->Display(false)))."\""; if ($imgsize) $text .= " /></a>\n"; else $text .= " />\n"; } else if ($USE_SILHOUETTE && isset($WT_IMAGES["default_image_U"])) { @@ -344,7 +344,7 @@ function print_td_person($n) { } $text .= "<a class=\"name1\" href=\"individual.php?pid=$pid\" title=\"$title\"> "; - $text .= PrintReady(htmlspecialchars(strip_tags($name),ENT_QUOTES,'UTF-8')); + $text .= PrintReady(htmlspecialchars(strip_tags($name))); if ($addname) $text .= "<br />" . PrintReady($addname); $text .= "</a>"; $text .= "<br />"; diff --git a/includes/classes/class_treenav.php b/includes/classes/class_treenav.php index 949546f460..9e02979216 100644 --- a/includes/classes/class_treenav.php +++ b/includes/classes/class_treenav.php @@ -173,7 +173,7 @@ class TreeNav { <table> <tr><td><a href="#" onclick="<?php print $this->name; ?>.zoomIn(); return false;"><img src="<?php print WT_SERVER_NAME.WT_SCRIPT_PATH.$WT_IMAGES['zoomin'];?>" border="0" alt="zoomin" /></a></td></tr> <tr><td><a href="#" onclick="<?php print $this->name; ?>.zoomOut(); return false;"><img src="<?php print WT_SERVER_NAME.WT_SCRIPT_PATH.$WT_IMAGES['zoomout'];?>" border="0" alt="zoomout" /></a></td></tr> - <tr><td <?php if (is_null($this->rootPerson) || WT_SCRIPT_NAME=='treenav.php') print "style=\"display: none;\"";?>><a id="biglink" href="#" onclick="<?php print $this->name; ?>.loadBigTree('<?php if (!is_null($this->rootPerson)) print $this->rootPerson->getXref();?>','<?php print htmlentities($GEDCOM,ENT_COMPAT,'UTF-8');?>'); return false;" title="<?php print i18n::translate('View this tree in the full page interactive tree'); ?>"><img src="<?php print WT_SERVER_NAME.WT_SCRIPT_PATH.$WT_IMAGES['tree'];?>" border="0" alt="" /></a></td></tr> + <tr><td <?php if (is_null($this->rootPerson) || WT_SCRIPT_NAME=='treenav.php') print "style=\"display: none;\"";?>><a id="biglink" href="#" onclick="<?php print $this->name; ?>.loadBigTree('<?php if (!is_null($this->rootPerson)) print $this->rootPerson->getXref();?>','<?php echo htmlspecialchars($GEDCOM); ?>'); return false;" title="<?php print i18n::translate('View this tree in the full page interactive tree'); ?>"><img src="<?php print WT_SERVER_NAME.WT_SCRIPT_PATH.$WT_IMAGES['tree'];?>" border="0" alt="" /></a></td></tr> <tr><td><a href="#" onclick="<?php print $this->name; ?>.toggleSpouses('<?php if ($this->rootPerson!=null) print $this->rootPerson->getXref(); ?>'); return false;" title="<?php print i18n::translate('Show or hide multiple spouses'); ?>"><img src="<?php print WT_SERVER_NAME.WT_SCRIPT_PATH.$WT_IMAGES['sfamily']; ?>" border="0" alt="" /></a></td></tr> <tr><td><?php echo help_link('treenav.php'); ?></td></tr> <tr><td><img id="<?php print $this->name; ?>_loading" src="<?php print WT_SERVER_NAME.WT_SCRIPT_PATH; ?>images/loading.gif" style="display: none;" alt="Loading..." /></td></tr> @@ -308,7 +308,7 @@ class TreeNav { echo $thumbnail; } ?> <a href="<?php print $person->getLinkUrl(); ?>" onclick="if (!<?php print $this->name;?>.collapseBox) return false;"><?php print $person->getSexImage().PrintReady($name); ?></a> - <img src="<?php print WT_SERVER_NAME.WT_SCRIPT_PATH.$WT_IMAGES["tree"];?>" border="0" width="15" onclick="<?php print $this->name;?>.newRoot('<?php print $person->getXref();?>', <?php print $this->name;?>.innerPort, '<?php print htmlentities($GEDCOM,ENT_COMPAT,'UTF-8'); ?>');" /> + <img src="<?php print WT_SERVER_NAME.WT_SCRIPT_PATH.$WT_IMAGES["tree"];?>" border="0" width="15" onclick="<?php print $this->name;?>.newRoot('<?php print $person->getXref();?>', <?php print $this->name;?>.innerPort, '<?php echo htmlspecialchars($GEDCOM); ?>');" /> </span><br /> <div class="details1 indent"> <?php @@ -347,7 +347,7 @@ class TreeNav { } ?> <a href="<?php print $spouse->getLinkUrl(); ?>" onclick="if (!<?php print $this->name;?>.collapseBox) return false;"> <?php print $spouse->getSexImage().PrintReady($name); ?></a> - <img src="<?php print WT_SERVER_NAME.WT_SCRIPT_PATH.$WT_IMAGES["tree"];?>" border="0" width="15" onclick="<?php print $this->name;?>.newRoot('<?php print $spouse->getXref();?>', <?php print $this->name;?>.innerPort, '<?php print htmlentities($GEDCOM,ENT_COMPAT,'UTF-8'); ?>');" /> + <img src="<?php print WT_SERVER_NAME.WT_SCRIPT_PATH.$WT_IMAGES["tree"];?>" border="0" width="15" onclick="<?php print $this->name;?>.newRoot('<?php print $spouse->getXref();?>', <?php print $this->name;?>.innerPort, '<?php echo htmlspecialchars($GEDCOM); ?>');" /> <br /> <div class="details1 indent"> <?php diff --git a/includes/controllers/individual_ctrl.php b/includes/controllers/individual_ctrl.php index 8119715905..c842fabc4e 100644 --- a/includes/controllers/individual_ctrl.php +++ b/includes/controllers/individual_ctrl.php @@ -318,13 +318,13 @@ class IndividualController extends BaseController { $name = $this->indi->getFullName(); if (WT_USE_LIGHTBOX) { - print "<a href=\"" . $firstmediarec["file"] . "\" rel=\"clearbox[general_1]\" rev=\"" . $mid . "::" . $GEDCOM . "::" . PrintReady(htmlspecialchars($name, ENT_QUOTES, 'UTF-8')) . "\">" . "\n"; + print "<a href=\"" . $firstmediarec["file"] . "\" rel=\"clearbox[general_1]\" rev=\"" . $mid . "::" . $GEDCOM . "::" . PrintReady(htmlspecialchars($name)) . "\">" . "\n"; } else if (!$USE_MEDIA_VIEWER && $imgsize) { $result .= "<a href=\"javascript:;\" onclick=\"return openImage('".urlencode($firstmediarec["file"])."', $imgwidth, $imgheight);\">"; } else { $result .= "<a href=\"mediaviewer.php?mid={$mid}\">"; } - $result .= "<img src=\"$filename\" align=\"left\" class=\"".$class."\" border=\"none\" title=\"".PrintReady(htmlspecialchars(strip_tags($name), ENT_QUOTES, 'UTF-8'))."\" alt=\"".PrintReady(htmlspecialchars(strip_tags($name), ENT_QUOTES, 'UTF-8'))."\" />"; + $result .= "<img src=\"$filename\" align=\"left\" class=\"".$class."\" border=\"none\" title=\"".PrintReady(htmlspecialchars(strip_tags($name)))."\" alt=\"".PrintReady(htmlspecialchars(strip_tags($name)))."\" />"; $result .= "</a>"; return $result; } diff --git a/includes/controllers/search_ctrl.php b/includes/controllers/search_ctrl.php index 35e126cde8..e06af63d9b 100644 --- a/includes/controllers/search_ctrl.php +++ b/includes/controllers/search_ctrl.php @@ -121,7 +121,7 @@ class SearchController extends BaseController { $this->myquery=""; } else { $this->query = $_REQUEST["query"]; - $this->myquery = htmlspecialchars($this->query,ENT_COMPAT,'UTF-8'); + $this->myquery = htmlspecialchars($this->query); } } if (isset ($_REQUEST["replace"])) { diff --git a/includes/functions/functions.php b/includes/functions/functions.php index 3a81689ebf..0c82fa38fb 100644 --- a/includes/functions/functions.php +++ b/includes/functions/functions.php @@ -114,7 +114,7 @@ function encode_url($url, $entities=true) { $url = decode_url($url, $entities); // Make sure we don't do any double conversions $url = str_replace(array(' ', '+', '@#', '"', "'"), array('%20', '%2b', '@%23', '%22', '%27'), $url); if ($entities) { - $url = htmlspecialchars($url, ENT_COMPAT, 'UTF-8'); + $url = htmlspecialchars($url); } return $url; } @@ -3374,28 +3374,28 @@ function mediaFileInfo($fileName, $thumbName, $mid, $name='', $notes='', $obeyVi require_once WT_ROOT.'modules/lightbox/lb_defaultconfig.php'; switch ($type) { case 'url_flv': - $url = encode_url('js/jw_player/flvVideo.php?flvVideo='.($fileName)) . "\" rel='clearbox(500, 392, click)' rev=\"" . $mid . "::" . $GEDCOM . "::" . PrintReady(htmlspecialchars($name, ENT_COMPAT, 'UTF-8')) . "::" . htmlspecialchars($notes, ENT_COMPAT, 'UTF-8'); + $url = encode_url('js/jw_player/flvVideo.php?flvVideo='.($fileName)) . "\" rel='clearbox(500, 392, click)' rev=\"" . $mid . "::" . $GEDCOM . "::" . PrintReady(htmlspecialchars($name)) . "::" . htmlspecialchars($notes); break 2; case 'local_flv': - $url = encode_url('js/jw_player/flvVideo.php?flvVideo='.(WT_SERVER_NAME.WT_SCRIPT_PATH.$fileName)) . "\" rel='clearbox(500, 392, click)' rev=\"" . $mid . "::" . $GEDCOM . "::" . PrintReady(htmlspecialchars($name, ENT_COMPAT, 'UTF-8')) . "::" . htmlspecialchars($notes, ENT_COMPAT, 'UTF-8'); + $url = encode_url('js/jw_player/flvVideo.php?flvVideo='.(WT_SERVER_NAME.WT_SCRIPT_PATH.$fileName)) . "\" rel='clearbox(500, 392, click)' rev=\"" . $mid . "::" . $GEDCOM . "::" . PrintReady(htmlspecialchars($name)) . "::" . htmlspecialchars($notes); break 2; case 'url_wmv': - $url = encode_url('js/jw_player/wmvVideo.php?wmvVideo='.($fileName)) . "\" rel='clearbox(500, 392, click)' rev=\"" . $mid . "::" . $GEDCOM . "::" . PrintReady(htmlspecialchars($name, ENT_COMPAT, 'UTF-8')) . "::" . htmlspecialchars($notes, ENT_COMPAT, 'UTF-8'); + $url = encode_url('js/jw_player/wmvVideo.php?wmvVideo='.($fileName)) . "\" rel='clearbox(500, 392, click)' rev=\"" . $mid . "::" . $GEDCOM . "::" . PrintReady(htmlspecialchars($name)) . "::" . htmlspecialchars($notes); break 2; case 'local_audio': case 'local_wmv': - $url = encode_url('js/jw_player/wmvVideo.php?wmvVideo='.(WT_SERVER_NAME.WT_SCRIPT_PATH.$fileName)) . "\" rel='clearbox(500, 392, click)' rev=\"" . $mid . "::" . $GEDCOM . "::" . PrintReady(htmlspecialchars($name, ENT_COMPAT, 'UTF-8')) . "::" . htmlspecialchars($notes, ENT_COMPAT, 'UTF-8'); + $url = encode_url('js/jw_player/wmvVideo.php?wmvVideo='.(WT_SERVER_NAME.WT_SCRIPT_PATH.$fileName)) . "\" rel='clearbox(500, 392, click)' rev=\"" . $mid . "::" . $GEDCOM . "::" . PrintReady(htmlspecialchars($name)) . "::" . htmlspecialchars($notes); break 2; case 'url_image': case 'local_image': - $url = encode_url($fileName) . "\" rel=\"clearbox[general]\" rev=\"" . $mid . "::" . $GEDCOM . "::" . PrintReady(htmlspecialchars($name, ENT_COMPAT, 'UTF-8')) . "::" . htmlspecialchars($notes, ENT_COMPAT, 'UTF-8'); + $url = encode_url($fileName) . "\" rel=\"clearbox[general]\" rev=\"" . $mid . "::" . $GEDCOM . "::" . PrintReady(htmlspecialchars($name)) . "::" . htmlspecialchars($notes); break 2; case 'url_picasa': case 'url_page': case 'url_other': case 'local_page': // case 'local_other': - $url = encode_url($fileName) . "\" rel='clearbox({$LB_URL_WIDTH}, {$LB_URL_HEIGHT}, click)' rev=\"" . $mid . "::" . $GEDCOM . "::" . PrintReady(htmlspecialchars($name, ENT_COMPAT, 'UTF-8')) . "::" . htmlspecialchars($notes, ENT_COMPAT, 'UTF-8'); + $url = encode_url($fileName) . "\" rel='clearbox({$LB_URL_WIDTH}, {$LB_URL_HEIGHT}, click)' rev=\"" . $mid . "::" . $GEDCOM . "::" . PrintReady(htmlspecialchars($name)) . "::" . htmlspecialchars($notes); break 2; case 'url_streetview': if (WT_SCRIPT_NAME != "media.php") { diff --git a/includes/functions/functions_edit.php b/includes/functions/functions_edit.php index 947083f8fb..b7e77d3ea3 100644 --- a/includes/functions/functions_edit.php +++ b/includes/functions/functions_edit.php @@ -1532,22 +1532,22 @@ function add_simple_tag($tag, $upperlevel='', $label='', $readOnly='', $noClose= echo "</select>"; } else if (($fact=="NAME" && $upperlevel!='REPO') || $fact=="_MARNM") { // Populated in javascript from sub-tags - echo "<input type=\"hidden\" id=\"", $element_id, "\" name=\"", $element_name, "\" onchange=\"updateTextName('", $element_id, "');\" value=\"", PrintReady(htmlspecialchars($value, ENT_COMPAT, 'UTF-8')), "\" />"; - echo "<span id=\"", $element_id, "_display\">", PrintReady(htmlspecialchars($value, ENT_COMPAT, 'UTF-8')), "</span>"; + echo "<input type=\"hidden\" id=\"", $element_id, "\" name=\"", $element_name, "\" onchange=\"updateTextName('", $element_id, "');\" value=\"", PrintReady(htmlspecialchars($value)), "\" />"; + echo "<span id=\"", $element_id, "_display\">", PrintReady(htmlspecialchars($value)), "</span>"; echo " <a href=\"#edit_name\" onclick=\"convertHidden('", $element_id, "'); return false;\"> "; if (isset($WT_IMAGES["edit_indi"])) echo "<img src=\"", $WT_IMAGES["edit_indi"], "\" border=\"0\" width=\"20\" alt=\"", i18n::translate('Edit name'), "\" align=\"top\" />"; else echo "<span class=\"age\">[", i18n::translate('Edit name'), "]</span>"; echo "</a>"; } else { // textarea - if ($rows>1) echo "<textarea id=\"", $element_id, "\" name=\"", $element_name, "\" rows=\"", $rows, "\" cols=\"", $cols, "\">", PrintReady(htmlspecialchars($value, ENT_COMPAT, 'UTF-8')), "</textarea><br />"; + if ($rows>1) echo "<textarea id=\"", $element_id, "\" name=\"", $element_name, "\" rows=\"", $rows, "\" cols=\"", $cols, "\">", PrintReady(htmlspecialchars($value)), "</textarea><br />"; else { // text // If using GEDFact-assistant window if ($action=="addnewnote_assisted") { - echo "<input type=\"text\" id=\"", $element_id, "\" name=\"", $element_name, "\" value=\"", PrintReady(htmlspecialchars($value,ENT_COMPAT,'UTF-8')), "\" style=\"width:4.1em;\" dir=\"ltr\""; + echo "<input type=\"text\" id=\"", $element_id, "\" name=\"", $element_name, "\" value=\"", PrintReady(htmlspecialchars($value)), "\" style=\"width:4.1em;\" dir=\"ltr\""; }else{ - echo "<input type=\"text\" id=\"", $element_id, "\" name=\"", $element_name, "\" value=\"", PrintReady(htmlspecialchars($value,ENT_COMPAT,'UTF-8')), "\" size=\"", $cols, "\" dir=\"ltr\""; + echo "<input type=\"text\" id=\"", $element_id, "\" name=\"", $element_name, "\" value=\"", PrintReady(htmlspecialchars($value)), "\" size=\"", $cols, "\" dir=\"ltr\""; } echo " class=\"{$fact}\""; echo " autocomplete=\"off\""; diff --git a/includes/functions/functions_mediadb.php b/includes/functions/functions_mediadb.php index e7abbbd271..95aab116e1 100644 --- a/includes/functions/functions_mediadb.php +++ b/includes/functions/functions_mediadb.php @@ -1235,12 +1235,12 @@ function show_media_form($pid, $action = "newentry", $filename = "", $linktoid = echo "\n<tr>"; echo "<td class=\"descriptionbox $TEXT_DIRECTION wrap width25\">\n"; - echo "<input name=\"oldFilename\" type=\"hidden\" value=\"" . addslashes($fileName) . "\" />"; + echo "<input name=\"oldFilename\" type=\"hidden\" value=\"" . htmlspecialchars($fileName) . "\" />"; echo i18n::translate('File name on server'), help_link('upload_server_file'); echo "</td>\n"; echo "<td class=\"optionbox wrap $TEXT_DIRECTION wrap\">"; if (WT_USER_GEDCOM_ADMIN) { - echo "<input name=\"filename\" type=\"text\" value=\"" . htmlentities($fileName, ENT_COMPAT, 'UTF-8') . "\" size=\"40\""; + echo "<input name=\"filename\" type=\"text\" value=\"" . htmlspecialchars($fileName) . "\" size=\"40\""; if ($isExternal) echo " />"; else @@ -1253,7 +1253,7 @@ function show_media_form($pid, $action = "newentry", $filename = "", $linktoid = print " alt=\"\" title=\"\" />"; } */ echo $fileName; - echo "<input name=\"filename\" type=\"hidden\" value=\"" . htmlentities($fileName, ENT_COMPAT, 'UTF-8') . "\" size=\"40\" />"; + echo "<input name=\"filename\" type=\"hidden\" value=\"" . htmlspecialchars($fileName) . "\" size=\"40\" />"; } echo "</td>"; echo "</tr>"; diff --git a/includes/functions/functions_print.php b/includes/functions/functions_print.php index 6713c9bf2b..0c8de0fe05 100644 --- a/includes/functions/functions_print.php +++ b/includes/functions/functions_print.php @@ -261,13 +261,13 @@ function print_pedigree_person($pid, $style=1, $count=0, $personcount="1") { $imgheight = $imgsize[1]+150; if (WT_USE_LIGHTBOX) { - $thumbnail .= "<a href=\"" . $object["file"] . "\" rel=\"clearbox[general_2]\" rev=\"" . $object['mid'] . "::" . $GEDCOM . "::" . PrintReady(htmlspecialchars($name, ENT_QUOTES, 'UTF-8')) . "\">"; + $thumbnail .= "<a href=\"" . $object["file"] . "\" rel=\"clearbox[general_2]\" rev=\"" . $object['mid'] . "::" . $GEDCOM . "::" . PrintReady(htmlspecialchars($name)) . "\">"; } else if (!empty($object['mid']) && $USE_MEDIA_VIEWER) { $thumbnail .= "<a href=\"".encode_url("mediaviewer.php?mid=".$object['mid'])."\" >"; } else { $thumbnail .= "<a href=\"javascript:;\" onclick=\"return openImage('".rawurlencode($object["file"])."', $imgwidth, $imgheight);\">"; } - $thumbnail .= "<img id=\"box-$boxID-thumb\" src=\"".$whichFile."\" vspace=\"0\" hspace=\"0\" class=\"$class\" alt=\"\" title=\"".PrintReady(htmlspecialchars(strip_tags($name), ENT_QUOTES, 'UTF-8'))."\""; + $thumbnail .= "<img id=\"box-$boxID-thumb\" src=\"".$whichFile."\" vspace=\"0\" hspace=\"0\" class=\"$class\" alt=\"\" title=\"".PrintReady(htmlspecialchars(strip_tags($name)))."\""; if (!$show_full) $thumbnail .= " style=\"display: none;\""; if ($imgsize) $thumbnail .= " /></a>"; else $thumbnail .= " />"; @@ -291,7 +291,6 @@ function print_pedigree_person($pid, $style=1, $count=0, $personcount="1") { } //-- find additional name $addname=$person->getAddName(); - //$name = PrintReady(htmlspecialchars(strip_tags($name), ENT_QUOTES, 'UTF-8')); $name = PrintReady($name); // add optional CSS style for each fact @@ -387,7 +386,7 @@ function print_header($title) { // The title often includes the names of records, which may have markup // that cannot be used in the page title. - $title=html_entity_decode(strip_tags($title), ENT_QUOTES, 'UTF-8'); + $title=strip_tags($title); if ($META_TITLE) { $title.=' - '.$META_TITLE; diff --git a/includes/functions/functions_print_facts.php b/includes/functions/functions_print_facts.php index 9686ef3a59..79bcf5c23c 100644 --- a/includes/functions/functions_print_facts.php +++ b/includes/functions/functions_print_facts.php @@ -86,7 +86,7 @@ function print_fact(&$eventObj, $noedit=false) { } $rawEvent = $eventObj->getDetail(); - $event = htmlspecialchars($rawEvent, ENT_COMPAT, 'UTF-8'); + $event = htmlspecialchars($rawEvent); $factrec = $eventObj->getGedcomRecord(); $linenum = $eventObj->getLineNumber(); $parent = $eventObj->getParentObject(); @@ -389,7 +389,7 @@ function print_fact(&$eventObj, $noedit=false) { } else { echo "<span class=\"label\">", $label, ": </span>"; } - echo htmlspecialchars($match[$i][2], ENT_COMPAT, 'UTF-8'); + echo htmlspecialchars($match[$i][2]); echo "<br />"; } } @@ -571,11 +571,11 @@ function print_media_links($factrec, $level, $pid='') { //LBox -------- change for Lightbox Album -------------------------------------------- if (WT_USE_LIGHTBOX && preg_match("/\.(jpe?g|gif|png)$/i", $mainMedia)) { $name = trim($row["m_titl"]); - echo "<a href=\"" . $mainMedia . "\" rel=\"clearbox[general_1]\" rev=\"" . $media_id . "::" . $GEDCOM . "::" . PrintReady(htmlspecialchars($name, ENT_COMPAT, 'UTF-8')) . "\">" . "\n"; + echo "<a href=\"" . $mainMedia . "\" rel=\"clearbox[general_1]\" rev=\"" . $media_id . "::" . $GEDCOM . "::" . PrintReady(htmlspecialchars($name)) . "\">" . "\n"; } else if (WT_USE_LIGHTBOX && preg_match("/\.(pdf|avi|txt)$/i", $mainMedia)) { require_once WT_ROOT.'modules/lightbox/lb_defaultconfig.php'; $name = trim($row["m_titl"]); - echo "<a href=\"" . $mainMedia . "\" rel='clearbox({$LB_URL_WIDTH}, {$LB_URL_HEIGHT}, click)' rev=\"" . $media_id . "::" . $GEDCOM . "::" . PrintReady(htmlspecialchars($name, ENT_COMPAT, 'UTF-8')) . "\">" . "\n"; + echo "<a href=\"" . $mainMedia . "\" rel='clearbox({$LB_URL_WIDTH}, {$LB_URL_HEIGHT}, click)' rev=\"" . $media_id . "::" . $GEDCOM . "::" . PrintReady(htmlspecialchars($name)) . "\">" . "\n"; // extra for Streetview ---------------------------------------- } else if (WT_USE_LIGHTBOX && strpos($row["m_file"], 'http://maps.google.')===0) { echo '<iframe style="float:left; padding:5px;" width="264" height="176" frameborder="0" scrolling="no" marginheight="0" marginwidth="0" src="', $row["m_file"], '&output=svembed"></iframe>'; @@ -1430,7 +1430,7 @@ function print_main_media_row($rtype, $rowm, $pid) { $before = substr($haystack, 0, strpos($haystack, $needle)); $after = substr(strstr($haystack, $needle), strlen($needle)); $final = $before.$needle.$after; - $notes = PrintReady(htmlspecialchars(addslashes(print_fact_notes($final, 1, true, true)), ENT_COMPAT, 'UTF-8')); + $notes = PrintReady(htmlspecialchars(addslashes(print_fact_notes($final, 1, true, true)))); $name = trim($rowm['m_titl']); @@ -1444,23 +1444,23 @@ function print_main_media_row($rtype, $rowm, $pid) { if (strpos($mainMedia, 'http://maps.google.')===0) { // } else { - echo ' alt="', PrintReady(htmlspecialchars($name, ENT_COMPAT, 'UTF-8')), '" title="', PrintReady(htmlspecialchars($name, ENT_COMPAT, 'UTF-8')), '" /></a>'; + echo ' alt="', PrintReady(htmlspecialchars($name)), '" title="', PrintReady(htmlspecialchars($name)), '" /></a>'; } if(empty($SEARCH_SPIDER)) { echo "<a href=\"", encode_url("mediaviewer.php?mid={$rowm['m_media']}"), "\">"; } if ($TEXT_DIRECTION=="rtl" && !hasRTLText($mediaTitle)) { - echo "<i>", getLRM(), PrintReady(htmlspecialchars($mediaTitle, ENT_COMPAT, 'UTF-8')); + echo "<i>", getLRM(), PrintReady(htmlspecialchars($mediaTitle)); } else { - echo "<i>", PrintReady(htmlspecialchars($mediaTitle, ENT_COMPAT, 'UTF-8')); + echo "<i>", PrintReady(htmlspecialchars($mediaTitle)); } $addtitle = get_gedcom_value("TITL:_HEB", 2, $rowm["m_gedrec"]); if (empty($addtitle)) $addtitle = get_gedcom_value("TITL:_HEB", 1, $rowm["m_gedrec"]); - if (!empty($addtitle)) echo "<br />\n", PrintReady(htmlspecialchars($addtitle, ENT_COMPAT, 'UTF-8')); + if (!empty($addtitle)) echo "<br />\n", PrintReady(htmlspecialchars($addtitle)); $addtitle = get_gedcom_value("TITL:ROMN", 2, $rowm["m_gedrec"]); if (empty($addtitle)) $addtitle = get_gedcom_value("TITL:ROMN", 1, $rowm["m_gedrec"]); - if (!empty($addtitle)) echo "<br />\n", PrintReady(htmlspecialchars($addtitle, ENT_COMPAT, 'UTF-8')); + if (!empty($addtitle)) echo "<br />\n", PrintReady(htmlspecialchars($addtitle)); echo "</i>"; if(empty($SEARCH_SPIDER)) { echo "</a>"; diff --git a/includes/functions/functions_print_lists.php b/includes/functions/functions_print_lists.php index 4c9749c8f4..1065053066 100644 --- a/includes/functions/functions_print_lists.php +++ b/includes/functions/functions_print_lists.php @@ -1179,7 +1179,7 @@ function format_surname_table($surnames, $type) { } $html.='</td>'; // Hidden column for sorting surnames - $html.='<td style="display:none;">'.htmlspecialchars($surn, ENT_COMPAT, 'UTF-8').'</td>'; + $html.='<td style="display:none;">'.htmlspecialchars($surn).'</td>'; // Surname count $html.='<td class="list_value_wrap">'; if (count($surns)==1) { @@ -170,10 +170,10 @@ echo '</td></tr></table><br /><br />'; ?> <form name="loginform" method="post" action="<?php print get_site_setting('LOGIN_URL'); ?>" onsubmit="t = new Date(); document.loginform.usertime.value=t.getFullYear()+'-'+(t.getMonth()+1)+'-'+t.getDate()+' '+t.getHours()+':'+t.getMinutes()+':'+t.getSeconds(); return true;"> <input type="hidden" name="action" value="login" /> - <input type="hidden" name="url" value="<?php print htmlentities($url,ENT_COMPAT,'UTF-8'); ?>" /> - <input type="hidden" name="ged" value="<?php if (isset($ged)) print htmlentities($ged,ENT_COMPAT,'UTF-8'); else print htmlentities($GEDCOM,ENT_COMPAT,'UTF-8'); ?>" /> - <input type="hidden" name="pid" value="<?php if (isset($pid)) print htmlentities($pid,ENT_COMPAT,'UTF-8'); ?>" /> - <input type="hidden" name="type" value="<?php print htmlentities($type,ENT_COMPAT,'UTF-8'); ?>" /> + <input type="hidden" name="url" value="<?php print htmlspecialchars($url); ?>" /> + <input type="hidden" name="ged" value="<?php if (isset($ged)) print htmlspecialchars($ged); else print htmlentities($GEDCOM); ?>" /> + <input type="hidden" name="pid" value="<?php if (isset($pid)) print htmlspecialchars($pid); ?>" /> + <input type="hidden" name="type" value="<?php print htmlspecialchars($type); ?>" /> <input type="hidden" name="usertime" value="" /> <?php if (!empty($message)) print "<span class='error'><br /><b>$message</b><br /><br /></span>\r\n"; @@ -183,7 +183,7 @@ echo '</td></tr></table><br /><br />'; <tr><td class="topbottombar" colspan="2"><?php print i18n::translate('Login'); ?></td></tr> <tr> <td class="descriptionbox <?php print $TEXT_DIRECTION; ?> wrap width50"><?php echo i18n::translate('User name'), help_link('username'); ?></td> - <td class="optionbox <?php print $TEXT_DIRECTION; ?>"><input type="text" name="username" value="<?php print htmlentities($username,ENT_COMPAT,'UTF-8'); ?>" size="20" class="formField" /></td> + <td class="optionbox <?php print $TEXT_DIRECTION; ?>"><input type="text" name="username" value="<?php print htmlspecialchars($username); ?>" size="20" class="formField" /></td> </tr> <tr> <td class="descriptionbox <?php print $TEXT_DIRECTION; ?> wrap width50"><?php echo i18n::translate('Password'), help_link('password'); ?></td> @@ -224,5 +224,8 @@ print "</div><br /><br />"; document.loginform.username.focus(); </script> <?php -if ($type=="full") print_footer(); -else print_simple_footer(); +if ($type=="full") { + print_footer(); +} else { + print_simple_footer(); +} @@ -1203,7 +1203,7 @@ jQuery(document).ready(function(){ $after = substr(strstr($haystack, $needle), strlen($needle)); $worked = str_replace("1 NOTE", "1 NOTE<br />", $after); $final = $before.$needle.$worked; - $notes = PrintReady(htmlspecialchars(addslashes(print_fact_notes($final, 1, true, true)), ENT_COMPAT, 'UTF-8')); + $notes = PrintReady(htmlspecialchars(addslashes(print_fact_notes($final, 1, true, true)))); // Get info on how to handle this media file $mediaInfo = mediaFileInfo($media["FILE"], $media["THUMB"], $media["XREF"], $name, $notes); @@ -1323,6 +1323,7 @@ jQuery(document).ready(function(){ } } ?> </div> <?php +} else { + echo i18n::translate('The media folder is corrupted.'); } -else echo i18n::translate('The media folder is corrupted.'); print_footer(); diff --git a/medialist.php b/medialist.php index 94ee96b782..6292eed742 100644 --- a/medialist.php +++ b/medialist.php @@ -528,7 +528,7 @@ if ($show == "yes") { $after = substr(strstr($haystack, $needle), strlen($needle)); $worked = str_replace("1 NOTE", "1 NOTE<br />", $after); $final = $before.$needle.$worked; - $notes = PrintReady(htmlspecialchars(addslashes(print_fact_notes($final, 1, true, true)), ENT_COMPAT, 'UTF-8')); + $notes = PrintReady(htmlspecialchars(addslashes(print_fact_notes($final, 1, true, true)))); // Get info on how to handle this media file $mediaInfo = mediaFileInfo($media["FILE"], $media["THUMB"], $media["XREF"], $name, $notes); @@ -537,7 +537,7 @@ if ($show == "yes") { if ($show_thumbnail) { echo '<a href="', $mediaInfo['url'], '">'; echo '<img src="', $mediaInfo['thumb'], '" align="center" class="thumbnail" border="none"', $mediaInfo['width']; - echo ' alt="', PrintReady(htmlspecialchars($name, ENT_COMPAT, 'UTF-8')), '" title="', PrintReady(htmlspecialchars($name, ENT_COMPAT, 'UTF-8')), '" /></a>'; + echo ' alt="', PrintReady(htmlspecialchars($name)), '" title="', PrintReady(htmlspecialchars($name)), '" /></a>'; echo "</td>\n\t\t", '<td class="list_value_wrap" style="border: none;" width="100%">'; diff --git a/mediaviewer.php b/mediaviewer.php index f90adf9046..36096376e4 100644 --- a/mediaviewer.php +++ b/mediaviewer.php @@ -100,7 +100,7 @@ if (WT_USE_LIGHTBOX) { echo '<img src="', $mediaInfo['thumb'], '" border="0" align="', $TEXT_DIRECTION=="rtl" ? "left":"right", '" class="thumbnail"', $mediaInfo['width']; // Finish off anchor and tooltips - print " alt=\"" . PrintReady(htmlspecialchars($name, ENT_COMPAT, 'UTF-8')) . "\" title=\"" . PrintReady(htmlspecialchars($name, ENT_COMPAT, 'UTF-8')) . "\" /></a>"; + print " alt=\"" . PrintReady(htmlspecialchars($name)) . "\" title=\"" . PrintReady(htmlspecialchars($name)) . "\" /></a>"; // If download if ($SHOW_MEDIA_DOWNLOAD) { @@ -110,7 +110,7 @@ if (WT_USE_LIGHTBOX) { // else the file is not external and does not exist } else { ?> - <img src="<?php print $controller->mediaobject->getThumbnail(); ?>" border="0" width="100" alt="<?php print $controller->mediaobject->getFullName(); ?>" title="<?php print PrintReady(htmlspecialchars($controller->mediaobject->getFullName(), ENT_COMPAT, 'UTF-8')); ?>" /> + <img src="<?php print $controller->mediaobject->getThumbnail(); ?>" border="0" width="100" alt="<?php print $controller->mediaobject->getFullName(); ?>" title="<?php print PrintReady(htmlspecialchars($controller->mediaobject->getFullName())); ?>" /> <span class="error"> <?php print i18n::translate('File not found.');?> </span> @@ -205,7 +205,6 @@ function ilinkitem(mediaid, type) { //--> </script> - <br /><br /><br /> <?php print_footer(); diff --git a/modules/lightbox/functions/lightbox_print_media_row.php b/modules/lightbox/functions/lightbox_print_media_row.php index 2c34e7e078..55377280d0 100644 --- a/modules/lightbox/functions/lightbox_print_media_row.php +++ b/modules/lightbox/functions/lightbox_print_media_row.php @@ -150,7 +150,7 @@ function lightbox_print_media_row($rtype, $rowm, $pid) { $before = substr($haystack, 0, strpos($haystack, $needle)); $after = substr(strstr($haystack, $needle), strlen($needle)); $final = $before.$needle.$after; - $notes = PrintReady(htmlspecialchars(addslashes(print_fact_notes($final, 1, true, true)),ENT_COMPAT,'UTF-8')); + $notes = PrintReady(htmlspecialchars(print_fact_notes($final, 1, true, true))); // Get info on how to handle this media file $mediaInfo = mediaFileInfo($mainMedia, $thumbnail, $rowm["m_media"], $mediaTitle, $notes); @@ -363,5 +363,4 @@ function lightbox_print_media_row($rtype, $rowm, $pid) { print "</li>"; print "\n\n"; return true; - } diff --git a/modules/user_messages/module.php b/modules/user_messages/module.php index cdf4aae367..073cd3e59f 100644 --- a/modules/user_messages/module.php +++ b/modules/user_messages/module.php @@ -143,9 +143,9 @@ class user_messages_WT_Module extends WT_Module implements WT_Module_Block { if ($user_id) { $content .= PrintReady(getUserFullName($user_id)); if ($TEXT_DIRECTION=="ltr") { - $content .= " " . getLRM() . " - ".htmlspecialchars(getUserEmail($user_id),ENT_COMPAT,'UTF-8') . getLRM(); + $content .= " " . getLRM() . " - ".htmlspecialchars(getUserEmail($user_id)) . getLRM(); } else { - $content .= " " . getRLM() . " - ".htmlspecialchars(getUserEmail($user_id),ENT_COMPAT,'UTF-8') . getRLM(); + $content .= " " . getRLM() . " - ".htmlspecialchars(getUserEmail($user_id)) . getRLM(); } } else { $content .= "<a href=\"mailto:".$message["from"]."\">".str_replace("@","@<span style=\"font-size:1px;\"> </span>",$message["from"])."</a>"; @@ -153,7 +153,7 @@ class user_messages_WT_Module extends WT_Module implements WT_Module_Block { $content .= "</td>"; $content .= "</tr>"; $content .= "<tr><td class=\"list_value_wrap\" colspan=\"5\"><div id=\"message$key\" style=\"display: none;\">"; - $message["body"] = nl2br(htmlspecialchars($message["body"],ENT_COMPAT,'UTF-8')); + $message["body"] = nl2br(htmlspecialchars($message["body"])); $message["body"] = expand_urls($message["body"]); $content .= PrintReady($message["body"])."<br /><br />"; @@ -214,4 +214,3 @@ class user_messages_WT_Module extends WT_Module implements WT_Module_Block { echo '</td></tr>'; } } -?> diff --git a/timeline.php b/timeline.php index 09fb75ec1b..0036fca97d 100644 --- a/timeline.php +++ b/timeline.php @@ -286,7 +286,7 @@ $controller->checkPrivacy(); <a href="individual.php?pid=<?php echo $pid; ?>"> <?php echo PrintReady($indi->getFullName()); ?><br /><br /> <?php $addname = $indi->getAddName(); if (strlen($addname) > 0) echo PrintReady($addname); ?> </a> - <input type="hidden" name="pids[<?php echo $p; ?>]" value="<?php echo htmlentities($pid, ENT_COMPAT, 'UTF-8'); ?>" /> + <input type="hidden" name="pids[<?php echo $p; ?>]" value="<?php echo htmlspecialchars($pid); ?>" /> <a href="timeline.php?<?php echo $controller->pidlinks; ?>&scale=<?php echo $controller->scale; ?>&remove=<?php echo $pid;?>" > <span class="details1"><?php echo i18n::translate('Remove person'), help_link('remove_person'); ?></span></a> <?php if (!empty($controller->birthyears[$pid])) { ?> @@ -301,7 +301,7 @@ $controller->checkPrivacy(); } else { print_privacy_error(); ?> - <input type="hidden" name="pids[<?php echo $p; ?>]" value="<?php echo htmlentities($pid, ENT_COMPAT, 'UTF-8'); ?>" /> + <input type="hidden" name="pids[<?php echo $p; ?>]" value="<?php echo htmlspecialchars($pid); ?>" /> <br /> <a href="timeline.php?<?php echo $controller->pidlinks; ?>&scale=<?php echo $controller->scale; ?>&remove=<?php echo $pid;?>" > <span class="details1"><?php echo i18n::translate('Remove person'), help_link('remove_person'); ?></span></a> |