diff options
72 files changed, 302 insertions, 304 deletions
diff --git a/admin_media.php b/admin_media.php index b9376b7c24..00a04bb735 100644 --- a/admin_media.php +++ b/admin_media.php @@ -312,11 +312,11 @@ switch ($action) { if (!$exists_pending) { foreach ($media_trees as $media_tree) { $create_form .= - '<p><a href="#" data-toggle="modal" data-target="#modal-create-media-from-file" data-file="' . Html::escape($unused_file) . '" data-tree="' . Html::escape($media_tree) . '" onclick="document.getElementById(\'file\').value=this.dataset.file; document.getElementById(\'ged\').value=this.dataset.tree;">' . I18N::translate('Create') . '</a> — ' . Html::escape($media_tree) . '<p>'; + '<p><a href="#" data-toggle="modal" data-target="#modal-create-media-from-file" data-file="' . e($unused_file) . '" data-tree="' . e($media_tree) . '" onclick="document.getElementById(\'file\').value=this.dataset.file; document.getElementById(\'ged\').value=this.dataset.tree;">' . I18N::translate('Create') . '</a> — ' . e($media_tree) . '<p>'; } } - $delete_link = '<p><a data-confirm="' . I18N::translate('Are you sure you want to delete “%s”?', Html::escape($unused_file)) . '" data-file="' . Html::escape($media_path . $unused_file) . '" data-folder="' . Html::escape($media_folder) . '" onclick="if (confirm(this.dataset.confirm)) jQuery.post(\'admin_media.php\',{delete: this.dataset.file, media_folder: this.dataset.folder},function(){location.reload();})" href="#">' . I18N::translate('Delete') . '</a></p>'; + $delete_link = '<p><a data-confirm="' . I18N::translate('Are you sure you want to delete “%s”?', e($unused_file)) . '" data-file="' . e($media_path . $unused_file) . '" data-folder="' . e($media_folder) . '" onclick="if (confirm(this.dataset.confirm)) jQuery.post(\'admin_media.php\',{delete: this.dataset.file, media_folder: this.dataset.folder},function(){location.reload();})" href="#">' . I18N::translate('Delete') . '</a></p>'; $data[] = [ mediaFileInfo($media_folder, $media_path, $unused_file) . $delete_link, @@ -480,7 +480,7 @@ function all_media_files($media_folder, $media_path, $subfolders, $filter) { function mediaFileInfo($media_folder, $media_path, $file) { $html = '<dl>'; $html .= '<dt>' . I18N::translate('Filename') . '</dt>'; - $html .= '<dd>' . Html::escape($file) . '</dd>'; + $html .= '<dd>' . e($file) . '</dd>'; $full_path = WT_DATA_DIR . $media_folder . $media_path . $file; try { @@ -519,7 +519,7 @@ function mediaFileInfo($media_folder, $media_path, $file) { * @return string HTML */ function mediaObjectInfo(Media $media) { - $html = '<b><a href="' . e($media->url()) . '">' . $media->getFullName() . '</a></b>' . '<br><i>' . Html::escape($media->getNote()) . '</i></br><br>'; + $html = '<b><a href="' . e($media->url()) . '">' . $media->getFullName() . '</a></b>' . '<br><i>' . e($media->getNote()) . '</i></br><br>'; $linked = []; foreach ($media->linkedIndividuals('OBJE') as $link) { @@ -625,16 +625,16 @@ echo Bootstrap4::breadcrumbs([ <?php if (count($media_folders) > 1): ?> <?= WT_DATA_DIR . Bootstrap4::select($media_folders, $media_folder, ['name' => 'media_folder', 'onchange' => 'this.form.submit();']) ?> <?php else: ?> - <?= WT_DATA_DIR . Html::escape($media_folder) ?> - <input type="hidden" name="media_folder" value="<?= Html::escape($media_folder) ?>"> + <?= WT_DATA_DIR . e($media_folder) ?> + <input type="hidden" name="media_folder" value="<?= e($media_folder) ?>"> <?php endif ?> </div> <?php if (count($media_paths) > 1): ?> <?= Bootstrap4::select($media_paths, $media_path, ['name' => 'media_path', 'onchange' => 'this.form.submit();']) ?> <?php else: ?> - <?= Html::escape($media_path) ?> - <input type="hidden" name="media_path" value="<?= Html::escape($media_path) ?>"> + <?= e($media_path) ?> + <input type="hidden" name="media_path" value="<?= e($media_path) ?>"> <?php endif ?> <label> @@ -650,8 +650,8 @@ echo Bootstrap4::breadcrumbs([ <?php elseif ($files === 'external'): ?> <?= I18N::translate('External media files have a URL instead of a filename.') ?> - <input type="hidden" name="media_folder" value="<?= Html::escape($media_folder) ?>"> - <input type="hidden" name="media_path" value="<?= Html::escape($media_path) ?>"> + <input type="hidden" name="media_folder" value="<?= e($media_folder) ?>"> + <input type="hidden" name="media_path" value="<?= e($media_path) ?>"> <?php endif ?> </td> diff --git a/admin_media_upload.php b/admin_media_upload.php index f66d31662a..acda0e083d 100644 --- a/admin_media_upload.php +++ b/admin_media_upload.php @@ -203,7 +203,7 @@ for ($i = 1; $i < 6; $i++) { echo '<option value="other" disabled>', I18N::translate('Other folder… please type in'), '</option>'; } foreach ($mediaFolders as $f) { - echo '<option value="', Html::escape($f), '">', Html::escape($f), '</option>'; + echo '<option value="', e($f), '">', e($f), '</option>'; } echo '</select>'; if (Auth::isAdmin()) { diff --git a/admin_pgv_to_wt.php b/admin_pgv_to_wt.php index c2a3dd73d9..bb95468ab8 100644 --- a/admin_pgv_to_wt.php +++ b/admin_pgv_to_wt.php @@ -146,7 +146,7 @@ if (!$PGV_PATH) { if (count($pgv_dirs) > 1) { $html = I18N::translate('PhpGedView might be installed in one of these folders:'); foreach ($pgv_dirs as $pgv_dir) { - $html .= '<div onclick="$(\'#PGV_PATH\').val(\'' . Html::escape($pgv_dir) . '\')">' . Html::escape($pgv_dir) . '</div>'; + $html .= '<div onclick="$(\'#PGV_PATH\').val(\'' . e($pgv_dir) . '\')">' . e($pgv_dir) . '</div>'; } echo Theme::theme()->htmlAlert($html, 'info', true); @@ -167,7 +167,7 @@ if (!$PGV_PATH) { name="PGV_PATH" size="40" placeholder="<?= I18N::translate('Installation folder') ?>" - value="<?= count($pgv_dirs) === 1 ? Html::escape($pgv_dirs[0]) : '' ?>" + value="<?= count($pgv_dirs) === 1 ? e($pgv_dirs[0]) : '' ?>" required > </div> diff --git a/admin_site_config.php b/admin_site_config.php index 807239cc38..7a30bb8ef7 100644 --- a/admin_site_config.php +++ b/admin_site_config.php @@ -33,7 +33,7 @@ switch (Filter::post('action')) { if (File::mkdir($INDEX_DIRECTORY)) { Site::setPreference('INDEX_DIRECTORY', $INDEX_DIRECTORY); } else { - FlashMessages::addMessage(I18N::translate('The folder %s does not exist, and it could not be created.', Html::escape($INDEX_DIRECTORY)), 'danger'); + FlashMessages::addMessage(I18N::translate('The folder %s does not exist, and it could not be created.', e($INDEX_DIRECTORY)), 'danger'); } Site::setPreference('MEMORY_LIMIT', Filter::post('MEMORY_LIMIT')); Site::setPreference('MAX_EXECUTION_TIME', Filter::post('MAX_EXECUTION_TIME')); @@ -177,7 +177,7 @@ echo Bootstrap4::breadcrumbs([ <?= /* I18N: A configuration setting */ I18N::translate('Data folder') ?> </label> <div class="col-sm-9"> - <input type="text" class="form-control" dir="ltr" id="INDEX_DIRECTORY" name="INDEX_DIRECTORY" value="<?= Html::escape(Site::getPreference('INDEX_DIRECTORY')) ?>" maxlength="255" placeholder="data/" required> + <input type="text" class="form-control" dir="ltr" id="INDEX_DIRECTORY" name="INDEX_DIRECTORY" value="<?= e(Site::getPreference('INDEX_DIRECTORY')) ?>" maxlength="255" placeholder="data/" required> <p class="small text-muted"> <?= /* I18N: Help text for the "Data folder" site configuration setting */ I18N::translate('This folder will be used by webtrees to store media files, GEDCOM files, temporary files, etc. These files may contain private data, and should not be made available over the internet.') ?> </p> @@ -199,7 +199,7 @@ echo Bootstrap4::breadcrumbs([ <?= /* I18N: A configuration setting */ I18N::translate('Memory limit') ?> </label> <div class="col-sm-9"> - <input type="text" class="form-control" id="MEMORY_LIMIT" name="MEMORY_LIMIT" value="<?= Html::escape(Site::getPreference('MEMORY_LIMIT')) ?>" pattern="[0-9]+[KMG]" placeholder="<?= get_cfg_var('memory_limit') ?>" maxlength="255"> + <input type="text" class="form-control" id="MEMORY_LIMIT" name="MEMORY_LIMIT" value="<?= e(Site::getPreference('MEMORY_LIMIT')) ?>" pattern="[0-9]+[KMG]" placeholder="<?= get_cfg_var('memory_limit') ?>" maxlength="255"> <p class="small text-muted"> <?= /* I18N: %s is an amount of memory, such as 32MB */ I18N::translate('By default, your server allows scripts to use %s of memory.', get_cfg_var('memory_limit')) ?> <?= I18N::translate('You can request a higher or lower limit, although the server may ignore this request.') ?> @@ -214,7 +214,7 @@ echo Bootstrap4::breadcrumbs([ <?= /* I18N: A configuration setting */ I18N::translate('PHP time limit') ?> </label> <div class="col-sm-9"> - <input type="text" class="form-control" id="MAX_EXECUTION_TIME" name="MAX_EXECUTION_TIME" value="<?= Html::escape(Site::getPreference('MAX_EXECUTION_TIME')) ?>" pattern="[0-9]*" placeholder="<?= get_cfg_var('max_execution_time') ?>" maxlength="255"> + <input type="text" class="form-control" id="MAX_EXECUTION_TIME" name="MAX_EXECUTION_TIME" value="<?= e(Site::getPreference('MAX_EXECUTION_TIME')) ?>" pattern="[0-9]*" placeholder="<?= get_cfg_var('max_execution_time') ?>" maxlength="255"> <p class="small text-muted"> <?= I18N::plural( 'By default, your server allows scripts to run for %s second.', @@ -289,7 +289,7 @@ echo Bootstrap4::breadcrumbs([ <?= /* I18N: A configuration setting */ I18N::translate('Session timeout') ?> </label> <div class="col-sm-9"> - <input type="text" class="form-control" id="SESSION_TIME" name="SESSION_TIME" value="<?= Html::escape(Site::getPreference('SESSION_TIME')) ?>" pattern="[0-9]*" placeholder="7200" maxlength="255"> + <input type="text" class="form-control" id="SESSION_TIME" name="SESSION_TIME" value="<?= e(Site::getPreference('SESSION_TIME')) ?>" pattern="[0-9]*" placeholder="7200" maxlength="255"> <p class="small text-muted"> <?= /* I18N: Help text for the “Session timeout” site configuration setting */ I18N::translate('The time in seconds that a webtrees session remains active before requiring a new sign-in. The default is 7200, which is 2 hours.') ?> <?= I18N::translate('Leave this blank to use the default value.') ?> @@ -319,7 +319,7 @@ echo Bootstrap4::breadcrumbs([ <?= /* I18N: A configuration setting */ I18N::translate('Sender name') ?> </label> <div class="col-sm-9"> - <input type="email" class="form-control" id="SMTP_FROM_NAME" name="SMTP_FROM_NAME" value="<?= Html::escape(Site::getPreference('SMTP_FROM_NAME')) ?>" placeholder="no-reply@localhost" maxlength="255"> + <input type="email" class="form-control" id="SMTP_FROM_NAME" name="SMTP_FROM_NAME" value="<?= e(Site::getPreference('SMTP_FROM_NAME')) ?>" placeholder="no-reply@localhost" maxlength="255"> <p class="small text-muted"> <?= /* I18N: Help text for the “Sender name” site configuration setting */ I18N::translate('This name is used in the “From” field, when sending automatic emails from this server.') ?> </p> @@ -334,7 +334,7 @@ echo Bootstrap4::breadcrumbs([ <?= /* I18N: A configuration setting */ I18N::translate('Server name') ?> </label> <div class="col-sm-9"> - <input type="text" class="form-control" id="SMTP_HOST" name="SMTP_HOST" value="<?= Html::escape(Site::getPreference('SMTP_HOST')) ?>" placeholder="smtp.example.com" maxlength="255" pattern="[a-z0-9-]+(\.[a-z0-9-]+)*"> + <input type="text" class="form-control" id="SMTP_HOST" name="SMTP_HOST" value="<?= e(Site::getPreference('SMTP_HOST')) ?>" placeholder="smtp.example.com" maxlength="255" pattern="[a-z0-9-]+(\.[a-z0-9-]+)*"> <p class="small text-muted"> <?= /* I18N: Help text for the “Server name” site configuration setting */ I18N::translate('This is the name of the SMTP server. “localhost” means that the mail service is running on the same computer as your web server.') ?> </p> @@ -347,7 +347,7 @@ echo Bootstrap4::breadcrumbs([ <?= /* I18N: A configuration setting */ I18N::translate('Port number') ?> </label> <div class="col-sm-9"> - <input type="text" class="form-control" id="SMTP_PORT" name="SMTP_PORT" value="<?= Html::escape(Site::getPreference('SMTP_PORT')) ?>" pattern="[0-9]*" placeholder="25" maxlength="5"> + <input type="text" class="form-control" id="SMTP_PORT" name="SMTP_PORT" value="<?= e(Site::getPreference('SMTP_PORT')) ?>" pattern="[0-9]*" placeholder="25" maxlength="5"> <p class="small text-muted"> <?= /* I18N: Help text for the "Port number" site configuration setting */ I18N::translate('By default, SMTP works on port 25.') ?> </p> @@ -375,7 +375,7 @@ echo Bootstrap4::breadcrumbs([ <?= /* I18N: A configuration setting */ I18N::translate('Username') ?> </label> <div class="col-sm-9"> - <input type="text" class="form-control" id="SMTP_AUTH_USER" name="SMTP_AUTH_USER" value="<?= Html::escape(Site::getPreference('SMTP_AUTH_USER')) ?>" maxlength="255"> + <input type="text" class="form-control" id="SMTP_AUTH_USER" name="SMTP_AUTH_USER" value="<?= e(Site::getPreference('SMTP_AUTH_USER')) ?>" maxlength="255"> <p class="small text-muted"> <?= /* I18N: Help text for the "Username" site configuration setting */ I18N::translate('The username required for authentication with the SMTP server.') ?> </p> @@ -414,7 +414,7 @@ echo Bootstrap4::breadcrumbs([ <?= /* I18N: A configuration setting */ I18N::translate('Sending server name') ?> </label> <div class="col-sm-9"> - <input type="text" class="form-control" id="SMTP_HELO" name="SMTP_HELO" value="<?= Html::escape(Site::getPreference('SMTP_HELO')) ?>" placeholder="localhost" maxlength="255" pattern="[a-z0-9-]+(\.[a-z0-9-]+)*"> + <input type="text" class="form-control" id="SMTP_HELO" name="SMTP_HELO" value="<?= e(Site::getPreference('SMTP_HELO')) ?>" placeholder="localhost" maxlength="255" pattern="[a-z0-9-]+(\.[a-z0-9-]+)*"> <p class="small text-muted"> <?= /* I18N: Help text for the "Sending server name" site configuration setting */ I18N::translate('Many mail servers require that the sending server identifies itself correctly, using a valid domain name.') ?> </p> @@ -439,7 +439,7 @@ echo Bootstrap4::breadcrumbs([ <?= /* I18N: A configuration setting */ I18N::translate('Sign-in URL') ?> </label> <div class="col-sm-9"> - <input type="text" class="form-control" id="LOGIN_URL" name="LOGIN_URL" value="<?= Html::escape(Site::getPreference('LOGIN_URL')) ?>" maxlength="255"> + <input type="text" class="form-control" id="LOGIN_URL" name="LOGIN_URL" value="<?= e(Site::getPreference('LOGIN_URL')) ?>" maxlength="255"> <p class="small text-muted"> <?= /* I18N: Help text for the "Login URL" site configuration setting */ I18N::translate('You only need to enter a Sign-in URL if you want to redirect to a different website or location when your users sign in. This is very useful if you need to switch from http to https when your users sign in. Include the full URL to <i>login.php</i>. For example, https://www.yourserver.com/webtrees/login.php .') ?> </p> @@ -464,7 +464,7 @@ echo Bootstrap4::breadcrumbs([ <?= /* I18N: A configuration setting */ I18N::translate('Custom welcome text') ?> </label> <div class="col-sm-9"> - <textarea class="form-control" maxlength="2000" id="WELCOME_TEXT_AUTH_MODE_4" name="WELCOME_TEXT_AUTH_MODE_4" rows="4"><?= Html::escape(Site::getPreference('WELCOME_TEXT_AUTH_MODE_' . WT_LOCALE)) ?></textarea> + <textarea class="form-control" maxlength="2000" id="WELCOME_TEXT_AUTH_MODE_4" name="WELCOME_TEXT_AUTH_MODE_4" rows="4"><?= e(Site::getPreference('WELCOME_TEXT_AUTH_MODE_' . WT_LOCALE)) ?></textarea> <p class="small text-muted"> <?= /* I18N: Help text for the "Custom welcome text" site configuration setting */ I18N::translate('To set this text for other languages, you must switch to that language, and visit this page again.') ?> </p> @@ -521,7 +521,7 @@ echo Bootstrap4::breadcrumbs([ <input type="text" class="form-control" id="BING_WEBMASTER_ID" name="BING_WEBMASTER_ID" <?= dirname(parse_url(WT_BASE_URL, PHP_URL_PATH)) === '/' ? '' : 'disabled' ?> - value="<?= Html::escape(Site::getPreference('BING_WEBMASTER_ID')) ?>" + value="<?= e(Site::getPreference('BING_WEBMASTER_ID')) ?>" maxlength="255" pattern="[0-9a-zA-Z+=/_:.!-]*" > <p class="small text-muted"> @@ -542,7 +542,7 @@ echo Bootstrap4::breadcrumbs([ <input type="text" class="form-control" id="GOOGLE_WEBMASTER_ID" name="GOOGLE_WEBMASTER_ID" <?= dirname(parse_url(WT_BASE_URL, PHP_URL_PATH)) === '/' ? '' : 'disabled' ?> - value="<?= Html::escape(Site::getPreference('GOOGLE_WEBMASTER_ID')) ?>" + value="<?= e(Site::getPreference('GOOGLE_WEBMASTER_ID')) ?>" maxlength="255" pattern="[0-9a-zA-Z+=/_:.!-]*" > <p class="small text-muted"> @@ -560,7 +560,7 @@ echo Bootstrap4::breadcrumbs([ <span class="sr-only">Google Analytics</span> </label> <div class="col-sm-9"> - <input type="text" class="form-control" id="GOOGLE_ANALYTICS_ID" name="GOOGLE_ANALYTICS_ID" value="<?= Html::escape(Site::getPreference('GOOGLE_ANALYTICS_ID')) ?>" placeholder="UA-12345-6" maxlength="255" pattern="UA-[0-9]+-[0-9]+"> + <input type="text" class="form-control" id="GOOGLE_ANALYTICS_ID" name="GOOGLE_ANALYTICS_ID" value="<?= e(Site::getPreference('GOOGLE_ANALYTICS_ID')) ?>" placeholder="UA-12345-6" maxlength="255" pattern="UA-[0-9]+-[0-9]+"> <p class="small text-muted"> <?= I18N::translate('Tracking and analytics are not added to the control panel.') ?> </p> @@ -575,7 +575,7 @@ echo Bootstrap4::breadcrumbs([ <?= /* I18N: A configuration setting */ I18N::translate('Site identification code') ?> </label> <div class="col-sm-9"> - <input type="text" class="form-control" id="PIWIK_SITE_ID" name="PIWIK_SITE_ID" value="<?= Html::escape(Site::getPreference('PIWIK_SITE_ID')) ?>" maxlength="255" pattern="[0-9]+"> + <input type="text" class="form-control" id="PIWIK_SITE_ID" name="PIWIK_SITE_ID" value="<?= e(Site::getPreference('PIWIK_SITE_ID')) ?>" maxlength="255" pattern="[0-9]+"> </div> </div> @@ -585,7 +585,7 @@ echo Bootstrap4::breadcrumbs([ <?= /* I18N: A configuration setting */ I18N::translate('URL') ?> </label> <div class="col-sm-9"> - <input type="text" class="form-control" id="PIWIK_URL" name="PIWIK_URL" value="<?= Html::escape(Site::getPreference('PIWIK_URL')) ?>" placeholder="example.com/piwik" maxlength="255"> + <input type="text" class="form-control" id="PIWIK_URL" name="PIWIK_URL" value="<?= e(Site::getPreference('PIWIK_URL')) ?>" placeholder="example.com/piwik" maxlength="255"> <p class="small text-muted"> <?= I18N::translate('Tracking and analytics are not added to the control panel.') ?> </p> @@ -600,7 +600,7 @@ echo Bootstrap4::breadcrumbs([ <?= /* I18N: A configuration setting */ I18N::translate('Site identification code') ?> </label> <div class="col-sm-9"> - <input type="text" class="form-control" id="STATCOUNTER_PROJECT_ID" name="STATCOUNTER_PROJECT_ID" value="<?= Html::escape(Site::getPreference('STATCOUNTER_PROJECT_ID')) ?>" maxlength="255" pattern="[0-9]+"> + <input type="text" class="form-control" id="STATCOUNTER_PROJECT_ID" name="STATCOUNTER_PROJECT_ID" value="<?= e(Site::getPreference('STATCOUNTER_PROJECT_ID')) ?>" maxlength="255" pattern="[0-9]+"> </div> </div> @@ -610,7 +610,7 @@ echo Bootstrap4::breadcrumbs([ <?= /* I18N: A configuration setting */ I18N::translate('Security code') ?> </label> <div class="col-sm-9"> - <input type="text" class="form-control" id="STATCOUNTER_SECURITY_ID" name="STATCOUNTER_SECURITY_ID" value="<?= Html::escape(Site::getPreference('STATCOUNTER_SECURITY_ID')) ?>" maxlength="255" pattern="[0-9a-zA-Z]+"> + <input type="text" class="form-control" id="STATCOUNTER_SECURITY_ID" name="STATCOUNTER_SECURITY_ID" value="<?= e(Site::getPreference('STATCOUNTER_SECURITY_ID')) ?>" maxlength="255" pattern="[0-9a-zA-Z]+"> <p class="small text-muted"> <?= I18N::translate('Tracking and analytics are not added to the control panel.') ?> </p> diff --git a/admin_site_logs.php b/admin_site_logs.php index e1096839d6..a34f0848ea 100644 --- a/admin_site_logs.php +++ b/admin_site_logs.php @@ -155,11 +155,11 @@ case 'load_json': // This becomes a JSON list, not array, so need to fetch with numeric keys. $data = Database::prepare($sql_select . $where . $order_by . $limit)->execute($args)->fetchAll(PDO::FETCH_NUM); foreach ($data as &$datum) { - $datum[2] = Html::escape($datum[2]); - $datum[3] = '<span dir="auto">' . Html::escape($datum[3]) . '</span>'; - $datum[4] = '<span dir="auto">' . Html::escape($datum[4]) . '</span>'; - $datum[5] = '<span dir="auto">' . Html::escape($datum[5]) . '</span>'; - $datum[6] = '<span dir="auto">' . Html::escape($datum[6]) . '</span>'; + $datum[2] = e($datum[2]); + $datum[3] = '<span dir="auto">' . e($datum[3]) . '</span>'; + $datum[4] = '<span dir="auto">' . e($datum[4]) . '</span>'; + $datum[5] = '<span dir="auto">' . e($datum[5]) . '</span>'; + $datum[6] = '<span dir="auto">' . e($datum[6]) . '</span>'; } // Total filtered/unfiltered rows @@ -237,7 +237,7 @@ echo Bootstrap4::breadcrumbs([ <?= /* I18N: label for the start of a date range (from x to y) */ I18N::translate('From') ?> </label> <div class="input-group date"> - <input type="text" autocomplete="off" class="form-control" id="from" name="from" value="<?= Html::escape($from) ?>"> + <input type="text" autocomplete="off" class="form-control" id="from" name="from" value="<?= e($from) ?>"> <div class="input-group-append"> <span class="input-group-text"> <span class="fas fa-calendar-alt"></span> @@ -251,7 +251,7 @@ echo Bootstrap4::breadcrumbs([ <?= /* I18N: label for the end of a date range (from x to y) */ I18N::translate('To') ?> </label> <div class="input-group date"> - <input type="text" autocomplete="off" class="form-control" id="to" name="to" value="<?= Html::escape($to) ?>"> + <input type="text" autocomplete="off" class="form-control" id="to" name="to" value="<?= e($to) ?>"> <div class="input-group-append"> <span class="input-group-text"> <span class="fas fa-calendar-alt"></span> @@ -271,7 +271,7 @@ echo Bootstrap4::breadcrumbs([ <label for="ip"> <?= I18N::translate('IP address') ?> </label> - <input class="form-control" type="text" id="ip" name="ip" value="<?= Html::escape($ip) ?>"> + <input class="form-control" type="text" id="ip" name="ip" value="<?= e($ip) ?>"> </div> </div> @@ -280,7 +280,7 @@ echo Bootstrap4::breadcrumbs([ <label for="text"> <?= I18N::translate('Message') ?> </label> - <input class="form-control" type="text" id="text" name="text" value="<?= Html::escape($text) ?>"> + <input class="form-control" type="text" id="text" name="text" value="<?= e($text) ?>"> </div> <div class="form-group col-sm-4"> diff --git a/admin_site_upgrade.php b/admin_site_upgrade.php index c562314200..01191c940a 100644 --- a/admin_site_upgrade.php +++ b/admin_site_upgrade.php @@ -144,7 +144,7 @@ if ($custom_modules) { if ($modules_action != 'ignore') { echo '<br>', I18N::translate('No custom modules are enabled.'), $icon_success; } - echo '<input type="hidden" name="modules" value="', Html::escape($modules_action), '">'; + echo '<input type="hidden" name="modules" value="', e($modules_action), '">'; } echo '</li>'; @@ -208,7 +208,7 @@ if ($custom_themes) { if ($themes_action != 'ignore') { echo '<br>', I18N::translate('No custom themes are enabled.'), $icon_success; } - echo '<input type="hidden" name="themes" value="', Html::escape($themes_action), '">'; + echo '<input type="hidden" name="themes" value="', e($themes_action), '">'; } echo '</li>'; diff --git a/admin_trees_config.php b/admin_trees_config.php index dc9f9778c6..0c6549cc0b 100644 --- a/admin_trees_config.php +++ b/admin_trees_config.php @@ -265,7 +265,7 @@ echo Bootstrap4::breadcrumbs([ name="title" required type="text" - value="<?= Html::escape($WT_TREE->getPreference('title')) ?>" + value="<?= e($WT_TREE->getPreference('title')) ?>" > </div> </div> @@ -394,7 +394,7 @@ echo Bootstrap4::breadcrumbs([ name="WEBTREES_EMAIL" required type="email" - value="<?= Html::escape($WT_TREE->getPreference('WEBTREES_EMAIL')) ?>" + value="<?= e($WT_TREE->getPreference('WEBTREES_EMAIL')) ?>" > <p class="small text-muted"> <?= /* I18N: Help text for the “webtrees reply address” configuration setting */ I18N::translate('Email address to be used in the “From:” field of emails that webtrees creates automatically.<br><br>webtrees can automatically create emails to notify administrators of changes that need to be reviewed. webtrees also sends notification emails to users who have requested an account.<br><br>Usually, the “From:” field of these automatically created emails is something like <i>From: webtrees-noreply@yoursite</i> to show that no response to the email is required. To guard against spam or other email abuse, some email systems require each message’s “From:” field to reflect a valid email account and will not accept messages that are apparently from account <i>webtrees-noreply</i>.') ?> @@ -413,7 +413,7 @@ echo Bootstrap4::breadcrumbs([ <?php foreach (User::all() as $user): ?> <?php if (Auth::isMember($WT_TREE, $user)): ?> <option value="<?= $user->getUserId() ?>" <?= $WT_TREE->getPreference('CONTACT_USER_ID') === $user->getUserId() ? 'selected' : '' ?>> - <?= $user->getRealNameHtml() ?> - <?= Html::escape($user->getUserName()) ?> + <?= $user->getRealNameHtml() ?> - <?= e($user->getUserName()) ?> </option> <?php endif ?> <?php endforeach ?> @@ -435,7 +435,7 @@ echo Bootstrap4::breadcrumbs([ <?php foreach (User::all() as $user): ?> <?php if (Auth::isMember($WT_TREE, $user)): ?> <option value="<?= $user->getUserId() ?>" <?= $WT_TREE->getPreference('WEBMASTER_USER_ID') === $user->getUserId() ? 'selected' : '' ?>> - <?= $user->getRealNameHtml() ?> - <?= Html::escape($user->getUserName()) ?> + <?= $user->getRealNameHtml() ?> - <?= e($user->getUserName()) ?> </option> <?php endif ?> <?php endforeach ?> @@ -460,7 +460,7 @@ echo Bootstrap4::breadcrumbs([ maxlength="255" name="META_TITLE" type="text" - value="<?= Html::escape($WT_TREE->getPreference('META_TITLE')) ?>" + value="<?= e($WT_TREE->getPreference('META_TITLE')) ?>" > <p class="small text-muted"> <?= /* I18N: Help text for the “Add to TITLE header tag” configuration setting */ I18N::translate('This text will be appended to each page title. It will be shown in the browser’s title bar, bookmarks, etc.') ?> @@ -480,7 +480,7 @@ echo Bootstrap4::breadcrumbs([ maxlength="255" name="META_DESCRIPTION" type="text" - value="<?= Html::escape($WT_TREE->getPreference('META_DESCRIPTION')) ?>" + value="<?= e($WT_TREE->getPreference('META_DESCRIPTION')) ?>" > <p class="small text-muted"> <?= /* I18N: Help text for the “Description META tag” configuration setting */ I18N::translate('The value to place in the “meta description” tag in the HTML page header. Leave this field empty to use the name of the family tree.') ?> @@ -537,7 +537,7 @@ echo Bootstrap4::breadcrumbs([ maxlength="255" name="MEDIA_DIRECTORY" type="text" - value="<?= Html::escape($WT_TREE->getPreference('MEDIA_DIRECTORY')) ?>" + value="<?= e($WT_TREE->getPreference('MEDIA_DIRECTORY')) ?>" > </div> <p class="small text-muted"> @@ -652,7 +652,7 @@ echo Bootstrap4::breadcrumbs([ name="SUBLIST_TRIGGER_I" required type="text" - value="<?= Html::escape($WT_TREE->getPreference('SUBLIST_TRIGGER_I')) ?>" + value="<?= e($WT_TREE->getPreference('SUBLIST_TRIGGER_I')) ?>" > <p class="small text-muted"> <?= /* I18N: Help text for the “Maximum number of surnames on individual list” configuration setting */ I18N::translate('Long lists of individuals with the same surname can be broken into smaller sub-lists according to the first letter of the individual’s given name.<br><br>This option determines when sub-listing of surnames will occur. To disable sub-listing completely, set this option to zero.') ?> @@ -719,7 +719,7 @@ echo Bootstrap4::breadcrumbs([ name="DEFAULT_PEDIGREE_GENERATIONS" required type="text" - value="<?= Html::escape($WT_TREE->getPreference('DEFAULT_PEDIGREE_GENERATIONS')) ?>" + value="<?= e($WT_TREE->getPreference('DEFAULT_PEDIGREE_GENERATIONS')) ?>" > <p class="small text-muted"> <?= /* I18N: Help text for the “Default pedigree generations” configuration setting */ I18N::translate('Set the default number of generations to display on descendancy and pedigree charts.') ?> @@ -739,7 +739,7 @@ echo Bootstrap4::breadcrumbs([ maxlength="5" name="MAX_PEDIGREE_GENERATIONS" type="text" - value="<?= Html::escape($WT_TREE->getPreference('MAX_PEDIGREE_GENERATIONS')) ?>" + value="<?= e($WT_TREE->getPreference('MAX_PEDIGREE_GENERATIONS')) ?>" > <p class="small text-muted"> <?= /* I18N: Help text for the “Maximum pedigree generations” configuration setting */ I18N::translate('Set the maximum number of generations to display on pedigree charts.') ?> @@ -759,7 +759,7 @@ echo Bootstrap4::breadcrumbs([ maxlength="5" name="MAX_DESCENDANCY_GENERATIONS" type="text" - value="<?= Html::escape($WT_TREE->getPreference('MAX_DESCENDANCY_GENERATIONS')) ?>" + value="<?= e($WT_TREE->getPreference('MAX_DESCENDANCY_GENERATIONS')) ?>" > <p class="small text-muted"> <?= /* I18N: Help text for the “Maximum descendancy generations” configuration setting */ I18N::translate('Set the maximum number of generations to display on descendancy charts.') ?> @@ -826,7 +826,7 @@ echo Bootstrap4::breadcrumbs([ maxlength="255" name="CHART_BOX_TAGS" type="text" - value="<?= Html::escape($WT_TREE->getPreference('CHART_BOX_TAGS')) ?>" + value="<?= e($WT_TREE->getPreference('CHART_BOX_TAGS')) ?>" > <div class="input-group-btn"> <a class="btn btn-default" onclick="return findFact('CHART_BOX_TAGS', 'INDI');"> @@ -1027,7 +1027,7 @@ echo Bootstrap4::breadcrumbs([ maxlength="255" name="GEONAMES_ACCOUNT" type="text" - value="<?= Html::escape($WT_TREE->getPreference('GEONAMES_ACCOUNT')) ?>" + value="<?= e($WT_TREE->getPreference('GEONAMES_ACCOUNT')) ?>" > <p class="small text-muted"> <?= /* I18N: Help text for the “Use GeoNames database for autocomplete on places” configuration setting */ I18N::translate('The website www.geonames.org provides a large database of place names. This can be searched when entering new places. To use this feature, you must register for a free account at www.geonames.org and provide the username.') ?> diff --git a/admin_trees_download.php b/admin_trees_download.php index 79ff0898c8..00b23cee79 100644 --- a/admin_trees_download.php +++ b/admin_trees_download.php @@ -177,11 +177,11 @@ echo Bootstrap4::breadcrumbs([ <?php if ($controller->tree()->getPreference('GEDCOM_MEDIA_PATH')): ?> <label> - <input type="checkbox" name="media-path" value="<?= Html::escape($controller->tree()->getPreference('GEDCOM_MEDIA_PATH')) ?>"> + <input type="checkbox" name="media-path" value="<?= e($controller->tree()->getPreference('GEDCOM_MEDIA_PATH')) ?>"> <?= /* I18N: A media path (e.g. C:\aaa\bbb\ccc\) in a GEDCOM file */ I18N::translate('Add the GEDCOM media path to filenames') ?> </label> <p> - <?= /* I18N: %s is the name of a folder. */ I18N::translate('Media filenames will be prefixed by %s.', '<code dir="ltr">' . Html::escape($controller->tree()->getPreference('GEDCOM_MEDIA_PATH')) . '</code>') ?> + <?= /* I18N: %s is the name of a folder. */ I18N::translate('Media filenames will be prefixed by %s.', '<code dir="ltr">' . e($controller->tree()->getPreference('GEDCOM_MEDIA_PATH')) . '</code>') ?> </p> <?php endif ?> diff --git a/admin_trees_duplicates.php b/admin_trees_duplicates.php index 5734b83149..53019c4195 100644 --- a/admin_trees_duplicates.php +++ b/admin_trees_duplicates.php @@ -165,7 +165,7 @@ echo Bootstrap4::breadcrumbs([ <?php endforeach ?> <?php if (count($duplicates) === 2): ?> — - <a href="<?= Html::escape(route('merge-records', ['ged' => $WT_TREE->getName(), 'xref1' => $duplicates[0]->getXref(), 'xref2' => $duplicates[1]->getXref()])) ?>"> + <a href="<?= e(route('merge-records', ['ged' => $WT_TREE->getName(), 'xref1' => $duplicates[0]->getXref(), 'xref2' => $duplicates[1]->getXref()])) ?>"> <?= I18N::translate('Merge') ?> </a> <?php endif ?> diff --git a/admin_trees_manage.php b/admin_trees_manage.php index d53b281ec2..3b05c1d3a8 100644 --- a/admin_trees_manage.php +++ b/admin_trees_manage.php @@ -68,10 +68,10 @@ switch (Filter::post('action')) { if (Filter::checkCsrf() && $basename && $tree_title) { if (Tree::findByName($basename)) { - FlashMessages::addMessage(/* I18N: %s is the name of a family tree */ I18N::translate('The family tree “%s” already exists.', Html::escape($basename)), 'danger'); + FlashMessages::addMessage(/* I18N: %s is the name of a family tree */ I18N::translate('The family tree “%s” already exists.', e($basename)), 'danger'); } else { Tree::create($basename, $tree_title); - FlashMessages::addMessage(/* I18N: %s is the name of a family tree */ I18N::translate('The family tree “%s” has been created.', Html::escape($basename)), 'success'); + FlashMessages::addMessage(/* I18N: %s is the name of a family tree */ I18N::translate('The family tree “%s” has been created.', e($basename)), 'success'); } } header('Location: admin_trees_manage.php?ged=' . rawurlencode($basename)); @@ -139,7 +139,7 @@ switch (Filter::post('action')) { if ($tree->getPreference('filemtime') != $filemtime) { $tree->importGedcomFile($gedcom_file, $basename); $tree->setPreference('filemtime', $filemtime); - FlashMessages::addMessage(I18N::translate('The GEDCOM file “%s” has been imported.', Html::escape($basename)), 'success'); + FlashMessages::addMessage(I18N::translate('The GEDCOM file “%s” has been imported.', e($basename)), 'success'); } } @@ -190,9 +190,9 @@ switch (Filter::get('action')) { <p> <?= /* I18N: %s is the name of a family tree */ I18N::translate('This will delete all the genealogy data from “%s” and replace it with data from a GEDCOM file.', $tree->getTitleHtml()) ?> </p> - <form class="form form-horizontal" name="gedcomimportform" method="post" enctype="multipart/form-data" onsubmit="return checkGedcomImportForm('<?= Html::escape(I18N::translate('You have selected a GEDCOM file with a different name. Is this correct?')) ?>');"> + <form class="form form-horizontal" name="gedcomimportform" method="post" enctype="multipart/form-data" onsubmit="return checkGedcomImportForm('<?= e(I18N::translate('You have selected a GEDCOM file with a different name. Is this correct?')) ?>');"> <input type="hidden" name="gedcom_id" value="<?= $tree->getTreeId() ?>"> - <input type="hidden" id="gedcom_filename" value="<?= Html::escape($gedcom_filename) ?>"> + <input type="hidden" id="gedcom_filename" value="<?= e($gedcom_filename) ?>"> <?= Filter::getCsrf() ?> <fieldset class="form-group"> @@ -239,11 +239,11 @@ switch (Filter::get('action')) { echo '<option value=""></option>'; sort($files); foreach ($files as $gedcom_file) { - echo '<option value="', Html::escape($gedcom_file), '" '; + echo '<option value="', e($gedcom_file), '" '; if ($gedcom_file === $gedcom_filename) { echo ' selected'; } - echo'>', Html::escape($gedcom_file), '</option>'; + echo'>', e($gedcom_file), '</option>'; } if (empty($files)) { echo '<option disabled selected>', I18N::translate('No GEDCOM files found.'), '</option>'; @@ -289,7 +289,7 @@ switch (Filter::get('action')) { maxlength="255" name="GEDCOM_MEDIA_PATH" type="text" - value="<?= Html::escape($WT_TREE->getPreference('GEDCOM_MEDIA_PATH')) ?>" + value="<?= e($WT_TREE->getPreference('GEDCOM_MEDIA_PATH')) ?>" > <p class="small text-muted"> <?= /* I18N: Help text for the “GEDCOM media path” configuration setting. A “path” is something like “C:\Documents\Genealogy\Photos\John_Smith.jpeg” */ I18N::translate('Some genealogy software creates GEDCOM files that contain media filenames with full paths. These paths will not exist on the web-server. To allow webtrees to find the file, the first part of the path must be removed.') ?> @@ -398,7 +398,7 @@ echo Bootstrap4::breadcrumbs([ <!-- PREFERENCES --> <li> <span class="fa-li"><i class="fas fa-cogs"></i></span> - <a href="<?= Html::escape(Html::url('admin_trees_config.php', ['ged' => $tree->getName(), 'action' => 'general'])) ?>"> + <a href="<?= e(Html::url('admin_trees_config.php', ['ged' => $tree->getName(), 'action' => 'general'])) ?>"> <?= I18N::translate('Preferences') ?> <span class="sr-only"> <?= $tree->getTitleHtml() ?> @@ -408,7 +408,7 @@ echo Bootstrap4::breadcrumbs([ <!-- PRIVACY --> <li> <span class="fa-li"><i class="fas fa-lock"></i></span> - <a href="<?= Html::escape(route('tree-privacy', ['ged' => $tree->getName()])) ?>"> + <a href="<?= e(route('tree-privacy', ['ged' => $tree->getName()])) ?>"> <?= I18N::translate('Privacy') ?> <span class="sr-only"> <?= $tree->getTitleHtml() ?> @@ -418,7 +418,7 @@ echo Bootstrap4::breadcrumbs([ <!-- HOME PAGE BLOCKS--> <li> <span class="fa-li"><i class="fas fa-th-large"></i></span> - <a href="<?= Html::escape(route('tree-page-edit', ['ged' => $tree->getName()])) ?>"> + <a href="<?= e(route('tree-page-edit', ['ged' => $tree->getName()])) ?>"> <?= I18N::translate('Change the “Home page” blocks') ?> <span class="sr-only"> <?= $tree->getTitleHtml() ?> @@ -428,7 +428,7 @@ echo Bootstrap4::breadcrumbs([ <!-- DELETE --> <li> <span class="fa-li"><i class="far fa-trash-alt"></i></span> - <a href="#" data-confirm="<?= I18N::translate('Are you sure you want to delete “%s”?', Html::escape($tree->getTitle())) ?>" onclick="if (confirm(this.dataset.confirm)) { document.delete_form<?= $tree->getTreeId() ?>.submit(); } return false;"> + <a href="#" data-confirm="<?= I18N::translate('Are you sure you want to delete “%s”?', e($tree->getTitle())) ?>" onclick="if (confirm(this.dataset.confirm)) { document.delete_form<?= $tree->getTreeId() ?>.submit(); } return false;"> <?= I18N::translate('Delete') ?> <span class="sr-only"> <?= $tree->getTitleHtml() ?> @@ -439,7 +439,7 @@ echo Bootstrap4::breadcrumbs([ <input type="hidden" name="gedcom_id" value="<?= $tree->getTreeId() ?>"> <?= Filter::getCsrf() ?> <!-- A11Y - forms need submit buttons, but they look ugly here --> - <button class="sr-only" data-confirm="<?= I18N::translate('Are you sure you want to delete “%s”?', Html::escape($tree->getTitle())) ?>" onclick="return confirm(this.dataset.confirm)" type="submit"> + <button class="sr-only" data-confirm="<?= I18N::translate('Are you sure you want to delete “%s”?', e($tree->getTitle())) ?>" onclick="return confirm(this.dataset.confirm)" type="submit"> <?= I18N::translate('Delete') ?> </button> </form> @@ -487,7 +487,7 @@ echo Bootstrap4::breadcrumbs([ <!-- MERGE --> <li> <span class="fa-li"><i class="fas fa-code-branch"></i></span> - <a href="<?= Html::escape(route('merge-records', ['ged' => $tree->getName()])) ?>"> + <a href="<?= e(route('merge-records', ['ged' => $tree->getName()])) ?>"> <?= I18N::translate('Merge records') ?> <span class="sr-only"> <?= $tree->getTitleHtml() ?> diff --git a/admin_trees_places.php b/admin_trees_places.php index 600be3df4f..7fdfe3bdde 100644 --- a/admin_trees_places.php +++ b/admin_trees_places.php @@ -94,9 +94,9 @@ echo Bootstrap4::breadcrumbs([ <form method="post"> <dl> <dt><label for="search"><?= I18N::translate('Search for') ?></label></dt> - <dd><input name="search" id="search" type="text" size="60" value="<?= Html::escape($search) ?>" data-autocomplete-type="PLAC" required autofocus></dd> + <dd><input name="search" id="search" type="text" size="60" value="<?= e($search) ?>" data-autocomplete-type="PLAC" required autofocus></dd> <dt><label for="replace"><?= I18N::translate('Replace with') ?></label></dt> - <dd><input name="replace" id="replace" type="text" size="60" value="<?= Html::escape($replace) ?>" data-autocomplete-type="PLAC" required></dd> + <dd><input name="replace" id="replace" type="text" size="60" value="<?= e($replace) ?>" data-autocomplete-type="PLAC" required></dd> </dl> <button type="submit" value="preview"><?= /* I18N: A button label. */ I18N::translate('preview') ?></button> <button type="submit" value="update" name="confirm"><?= /* I18N: A button label. */ I18N::translate('update') ?></button> @@ -110,9 +110,9 @@ echo Bootstrap4::breadcrumbs([ <ul> <?php foreach ($changes as $old_place => $new_place) { ?> <li> - <?= Html::escape($old_place) ?> + <?= e($old_place) ?> → - <?= Html::escape($new_place) ?> + <?= e($new_place) ?> </li> <?php } ?> </ul> diff --git a/admin_users.php b/admin_users.php index 5c34398137..77f1496bb6 100644 --- a/admin_users.php +++ b/admin_users.php @@ -215,21 +215,21 @@ case 'load_json': $user_name = $datum[2]; if ($user_id != Auth::id()) { - $admin_options = '<div class="dropdown-item"><a href="#" onclick="return masquerade(' . $user_id . ')"><i class="far fa-user fa-fw"></i> ' . /* I18N: Pretend to be another user, by logging in as them */ I18N::translate('Masquerade as this user') . '</a></div>' . '<div class="dropdown-item"><a href="#" data-confirm="' . I18N::translate('Are you sure you want to delete “%s”?', Html::escape($user_name)) . '" onclick="delete_user(this.dataset.confirm, ' . $user_id . ');"><i class="fas fa-trash-alt fa-fw" aria-hidden="true"></i> ' . I18N::translate('Delete') . '</a></div>'; + $admin_options = '<div class="dropdown-item"><a href="#" onclick="return masquerade(' . $user_id . ')"><i class="far fa-user fa-fw"></i> ' . /* I18N: Pretend to be another user, by logging in as them */ I18N::translate('Masquerade as this user') . '</a></div>' . '<div class="dropdown-item"><a href="#" data-confirm="' . I18N::translate('Are you sure you want to delete “%s”?', e($user_name)) . '" onclick="delete_user(this.dataset.confirm, ' . $user_id . ');"><i class="fas fa-trash-alt fa-fw" aria-hidden="true"></i> ' . I18N::translate('Delete') . '</a></div>'; } else { // Do not delete ourself! $admin_options = ''; } - $datum[0] = '<div class="dropdown"><button type="button" class="btn btn-primary dropdown-toggle" data-toggle="dropdown" id="edit-user-button-' . $user_id . '" aria-haspopup="true" aria-expanded="false"><i class="fas fa-pencil-alt"></i> <span class="caret"></span></button><div class="dropdown-menu" aria-labelledby="edit-user-button-' . $user_id . '"><div class="dropdown-item"><a href="?action=edit&user_id=' . $user_id . '"><i class="fas fa-pencil-alt fa-fw"></i> ' . I18N::translate('Edit') . '</a></div><div class="divider"></div><div class="dropdown-item"><a href="' . Html::escape(route('user-page-user-edit', ['user_id' => $user_id])) . '"><i class="fas fa-th-large fa-fw" aria-hidden="true"></i> ' . I18N::translate('Change the blocks on this user’s “My page”') . '</a></div>' . $admin_options . '</div></div>'; + $datum[0] = '<div class="dropdown"><button type="button" class="btn btn-primary dropdown-toggle" data-toggle="dropdown" id="edit-user-button-' . $user_id . '" aria-haspopup="true" aria-expanded="false"><i class="fas fa-pencil-alt"></i> <span class="caret"></span></button><div class="dropdown-menu" aria-labelledby="edit-user-button-' . $user_id . '"><div class="dropdown-item"><a href="?action=edit&user_id=' . $user_id . '"><i class="fas fa-pencil-alt fa-fw"></i> ' . I18N::translate('Edit') . '</a></div><div class="divider"></div><div class="dropdown-item"><a href="' . e(route('user-page-user-edit', ['user_id' => $user_id])) . '"><i class="fas fa-th-large fa-fw" aria-hidden="true"></i> ' . I18N::translate('Change the blocks on this user’s “My page”') . '</a></div>' . $admin_options . '</div></div>'; // The real name - $datum[3] = '<span dir="auto">' . Html::escape($datum[3]) . '</span>'; + $datum[3] = '<span dir="auto">' . e($datum[3]) . '</span>'; // $datum[4] is the email address if ($user_id != Auth::id()) { - $datum[4] = '<a href="' . Html::escape(Html::url('message.php', ['to' => $datum[2], 'url' => 'admin_users.php'])) . '">' . Html::escape($datum[4]) . '</a>'; + $datum[4] = '<a href="' . e(Html::url('message.php', ['to' => $datum[2], 'url' => 'admin_users.php'])) . '">' . e($datum[4]) . '</a>'; } // The username - $datum[2] = '<span dir="auto">' . Html::escape($datum[2]) . '</span>'; + $datum[2] = '<span dir="auto">' . e($datum[2]) . '</span>'; // The langauge if (array_key_exists($datum[5], $installed_languages)) { $datum[5] = $installed_languages[$datum[5]]; @@ -316,7 +316,7 @@ case 'edit': <?= I18N::translate('Real name') ?> </label> <div class="col-sm-9"> - <input class="form-control" type="text" id="real_name" name="real_name" required maxlength="64" value="<?= Html::escape($user->getRealName()) ?>" dir="auto"> + <input class="form-control" type="text" id="real_name" name="real_name" required maxlength="64" value="<?= e($user->getRealName()) ?>" dir="auto"> <p class="small text-muted"> <?= I18N::translate('This is your real name, as you would like it displayed on screen.') ?> </p> @@ -329,7 +329,7 @@ case 'edit': <?= I18N::translate('Username') ?> </label> <div class="col-sm-9"> - <input class="form-control" type="text" id="username" name="username" required maxlength="32" value="<?= Html::escape($user->getUserName()) ?>" dir="auto"> + <input class="form-control" type="text" id="username" name="username" required maxlength="32" value="<?= e($user->getUserName()) ?>" dir="auto"> <p class="small text-muted"> <?= I18N::translate('Usernames are case-insensitive and ignore accented letters, so that “chloe”, “chloë”, and “Chloe” are considered to be the same.') ?> </p> @@ -365,7 +365,7 @@ case 'edit': <?= I18N::translate('Email address') ?> </label> <div class="col-sm-9"> - <input class="form-control" type="email" id="email" name="email" required maxlength="64" value="<?= Html::escape($user->getEmail()) ?>"> + <input class="form-control" type="email" id="email" name="email" required maxlength="64" value="<?= e($user->getEmail()) ?>"> <p class="small text-muted"> <?= I18N::translate('This email address will be used to send password reminders, website notifications, and messages from other family members who are registered on the website.') ?> </p> @@ -499,7 +499,7 @@ case 'edit': <?= I18N::translate('Administrator comments on user') ?> </label> <div class="col-sm-9"> - <textarea class="form-control" id="comment" name="comment" rows="5" maxlength="255"><?= Html::escape($user->getPreference('comment')) ?></textarea> + <textarea class="form-control" id="comment" name="comment" rows="5" maxlength="255"><?= e($user->getPreference('comment')) ?></textarea> </div> </div> @@ -696,7 +696,7 @@ case 'cleanup': <tr> <td> <a href="?action=edit&user_id=<?= $user->getUserId() ?>"> - <?= Html::escape($user->getUserName()) ?> + <?= e($user->getUserName()) ?> — <?= $user->getRealNameHtml() ?> </a> @@ -720,7 +720,7 @@ case 'cleanup': <tr> <td> <a href="?action=edit&user_id=<?= $user->getUserId() ?>"> - <?= Html::escape($user->getUserName()) ?> + <?= e($user->getUserName()) ?> — <?= $user->getRealNameHtml() ?> </a> @@ -744,7 +744,7 @@ case 'cleanup': <tr> <td> <a href="?action=edit&user_id=<?= $user->getUserId() ?>"> - <?= Html::escape($user->getUserName()) ?> + <?= e($user->getUserName()) ?> — <?= $user->getRealNameHtml() ?> </a> @@ -777,7 +777,7 @@ case 'cleanup2': if (Filter::post('del_' . $user->getUserId()) == '1') { Log::addAuthenticationLog('Deleted user: ' . $user->getUserName()); $user->delete(); - I18N::translate('The user %s has been deleted.', Html::escape($user->getUserName())); + I18N::translate('The user %s has been deleted.', e($user->getUserName())); } } diff --git a/ancestry.php b/ancestry.php index 60757ef1ff..e8a1393ab0 100644 --- a/ancestry.php +++ b/ancestry.php @@ -87,4 +87,4 @@ $controller->pageHeader(); </div> </form> -<div class="wt-ajax-load wt-page-content wt-chart wt-ancestors-chart" data-ajax-url="<?= Html::escape($ajax_url) ?>"></div> +<div class="wt-ajax-load wt-page-content wt-chart wt-ancestors-chart" data-ajax-url="<?= e($ajax_url) ?>"></div> diff --git a/app/Controller/BranchesController.php b/app/Controller/BranchesController.php index 4f025cce1f..051a88fc2c 100644 --- a/app/Controller/BranchesController.php +++ b/app/Controller/BranchesController.php @@ -56,7 +56,7 @@ class BranchesController extends PageController { if ($this->surname !== '') { $this->setPageTitle(/* I18N: %s is a surname */ - I18N::translate('Branches of the %s family', Html::escape($this->surname))); + I18N::translate('Branches of the %s family', e($this->surname))); $this->loadIndividuals(); $self = Individual::getInstance($this->tree()->getUserPreference(Auth::user(), 'gedcomid'), $this->tree()); if ($self) { diff --git a/app/Controller/IndividualController.php b/app/Controller/IndividualController.php index 4980c91e49..f63caa41b4 100644 --- a/app/Controller/IndividualController.php +++ b/app/Controller/IndividualController.php @@ -162,7 +162,7 @@ class IndividualController extends GedcomRecordController { echo '<dt class="label">', GedcomTag::getLabel($tag, $this->record), '</dt>'; echo '<dd class="field">'; // Before using dir="auto" on this field, note that Gecko treats this as an inline element but WebKit treats it as a block element if (isset($nmatch[$i][2])) { - $name = Html::escape($nmatch[$i][2]); + $name = e($nmatch[$i][2]); $name = str_replace('/', '', $name); $name = preg_replace('/(\S*)\*/', '<span class="starredname">\\1</span>', $name); switch ($tag) { @@ -172,7 +172,7 @@ class IndividualController extends GedcomRecordController { case 'SURN': // The SURN field is not necessarily the surname. // Where it is not a substring of the real surname, show it after the real surname. - $surname = Html::escape($dummy->getAllNames()[0]['surname']); + $surname = e($dummy->getAllNames()[0]['surname']); $surns = preg_replace('/, */', ' ', $nmatch[$i][2]); if (strpos($dummy->getAllNames()[0]['surname'], $surns) !== false) { echo '<span dir="auto">' . $surname . '</span>'; diff --git a/app/Controller/IndividualListController.php b/app/Controller/IndividualListController.php index a480a30952..8ecbcc3175 100644 --- a/app/Controller/IndividualListController.php +++ b/app/Controller/IndividualListController.php @@ -542,7 +542,7 @@ class IndividualListController extends PageController { return I18N::translateContext('Unknown given name', '…'); break; default: - return Html::escape($initial); + return e($initial); break; } } @@ -563,7 +563,7 @@ class IndividualListController extends PageController { return I18N::translate('None'); break; default: - return Html::escape($initial); + return e($initial); break; } } diff --git a/app/Controller/TimelineController.php b/app/Controller/TimelineController.php index 16bb55d223..317008aaa8 100644 --- a/app/Controller/TimelineController.php +++ b/app/Controller/TimelineController.php @@ -233,7 +233,7 @@ class TimelineController extends PageController { echo '<span class="age"> ', I18N::translate('Age'), ' ', $ageh, '</span>'; } } - echo ' ' . Html::escape($desc); + echo ' ' . e($desc); if (!$event->getPlace()->isEmpty()) { echo ' — ' . $event->getPlace()->getShortName(); } diff --git a/app/Fact.php b/app/Fact.php index 08d8bee9e7..654ebadd8f 100644 --- a/app/Fact.php +++ b/app/Fact.php @@ -267,7 +267,7 @@ class Fact { case 'FACT': if ($this->getAttribute('TYPE') !== '') { // Custom FACT/EVEN - with a TYPE - return I18N::translate(Html::escape($this->getAttribute('TYPE'))); + return I18N::translate(e($this->getAttribute('TYPE'))); } // no break - drop into next case default: @@ -384,7 +384,7 @@ class Fact { // Fact value $value = $this->getValue(); if ($value !== '' && $value !== 'Y') { - $attributes[] = '<span dir="auto">' . Html::escape($value) . '</span>'; + $attributes[] = '<span dir="auto">' . e($value) . '</span>'; } // Fact date $date = $this->getDate(); diff --git a/app/Functions/FunctionsEdit.php b/app/Functions/FunctionsEdit.php index 60cb468b6b..a12d70bbf6 100644 --- a/app/Functions/FunctionsEdit.php +++ b/app/Functions/FunctionsEdit.php @@ -694,11 +694,11 @@ class FunctionsEdit { } } } elseif ($fact === 'NPFX' || $fact === 'NSFX' || $fact === 'SPFX' || $fact === 'NICK') { - $html .= '<input class="form-control" type="text" id="' . $id . '" name="' . $name . '" value="' . Html::escape($value) . '" oninput="updatewholename()">'; + $html .= '<input class="form-control" type="text" id="' . $id . '" name="' . $name . '" value="' . e($value) . '" oninput="updatewholename()">'; } elseif ($fact === 'GIVN') { - $html .= '<input class="form-control" type="text" id="' . $id . '" name="' . $name . '" value="' . Html::escape($value) . '" data-autocomplete-type="GIVN" oninput="updatewholename()" autofocus>'; + $html .= '<input class="form-control" type="text" id="' . $id . '" name="' . $name . '" value="' . e($value) . '" data-autocomplete-type="GIVN" oninput="updatewholename()" autofocus>'; } elseif ($fact === 'SURN' || $fact === '_MARNM_SURN') { - $html .= '<input class="form-control" type="text" id="' . $id . '" name="' . $name . '" value="' . Html::escape($value) . '" data-autocomplete-type="SURN" oninput="updatewholename()">'; + $html .= '<input class="form-control" type="text" id="' . $id . '" name="' . $name . '" value="' . e($value) . '" data-autocomplete-type="SURN" oninput="updatewholename()">'; } elseif ($fact === 'ADOP') { $html .= Bootstrap4::select(GedcomCodeAdop::getValues($person), $value, ['id' => $id, 'name' => $name]); } elseif ($fact === 'ALIA') { @@ -716,7 +716,7 @@ class FunctionsEdit { } } elseif ($fact === 'DATE') { $html .= '<div class="input-group">'; - $html .= '<input class="form-control" type="text" id="' . $id . '" name="' . $name . '" value="' . Html::escape($value) . '" onchange="valid_date(this)">'; + $html .= '<input class="form-control" type="text" id="' . $id . '" name="' . $name . '" value="' . e($value) . '" onchange="valid_date(this)">'; $html .= self::inputAddonCalendar($id); $html .= self::inputAddonHelp('DATE'); $html .= '</div>'; @@ -729,9 +729,9 @@ class FunctionsEdit { self::formControlFamily(Family::getInstance($value, $WT_TREE), ['id' => $id, 'name' => $name]) . '</div>'; } elseif ($fact === 'LATI') { - $html .= '<input class="form-control" type="text" id="' . $id . '" name="' . $name . '" value="' . Html::escape($value) . '" oninput="valid_lati_long(this, \'N\', \'S\')">'; + $html .= '<input class="form-control" type="text" id="' . $id . '" name="' . $name . '" value="' . e($value) . '" oninput="valid_lati_long(this, \'N\', \'S\')">'; } elseif ($fact === 'LONG') { - $html .= '<input class="form-control" type="text" id="' . $id . '" name="' . $name . '" value="' . Html::escape($value) . '" oninput="valid_lati_long(this, \'E\', \'W\')">'; + $html .= '<input class="form-control" type="text" id="' . $id . '" name="' . $name . '" value="' . e($value) . '" oninput="valid_lati_long(this, \'E\', \'W\')">'; } elseif ($fact === 'NOTE' && $islink) { $html .= '<div class="input-group">' . @@ -749,7 +749,7 @@ class FunctionsEdit { self::formControlMediaObject(Media::getInstance($value, $WT_TREE), ['id' => $id, 'name' => $name]) . '</div>'; } elseif ($fact === 'PAGE') { - $html .= '<input class="form-control" type="text" id="' . $id . '" name="' . $name . '" value="' . Html::escape($value) . '" data-autocomplete-type="PAGE" data-autocomplete-extra="#' . $previous_ids['SOUR'] . '">'; + $html .= '<input class="form-control" type="text" id="' . $id . '" name="' . $name . '" value="' . e($value) . '" data-autocomplete-type="PAGE" data-autocomplete-extra="#' . $previous_ids['SOUR'] . '">'; } elseif ($fact === 'PEDI') { $html .= Bootstrap4::select(GedcomCodePedi::getValues($person), $value, ['id' => $id, 'name' => $name]); } elseif ($fact === 'PLAC') { @@ -809,7 +809,7 @@ class FunctionsEdit { } elseif ($fact === 'TEMP') { $html .= Bootstrap4::select(FunctionsEdit::optionsTemples(), $value, ['id' => $id, 'name' => $name]); } elseif ($fact === 'TIME') { - $html .= '<input class="form-control" type="text" id="' . $id . '" name="' . $name . '" value="' . Html::escape($value) . '" pattern="([0-1][0-9]|2[0-3]):[0-5][0-9](:[0-5][0-9])?" dir="ltr" placeholder="' . /* I18N: Examples of valid time formats (hours:minutes:seconds) */ I18N::translate('hh:mm or hh:mm:ss') . '">'; + $html .= '<input class="form-control" type="text" id="' . $id . '" name="' . $name . '" value="' . e($value) . '" pattern="([0-1][0-9]|2[0-3]):[0-5][0-9](:[0-5][0-9])?" dir="ltr" placeholder="' . /* I18N: Examples of valid time formats (hours:minutes:seconds) */ I18N::translate('hh:mm or hh:mm:ss') . '">'; } elseif ($fact === '_WT_USER') { $html .= Bootstrap4::select(FunctionsEdit::optionsUsers(), $value, ['id' => $id, 'name' => $name]); } elseif ($fact === '_PRIM') { @@ -820,7 +820,7 @@ class FunctionsEdit { $html .= '<select name="text[]"><option selected value="" ></option>'; $selectedValue = strtolower($value); if (!array_key_exists($selectedValue, GedcomTag::getFileFormTypes())) { - $html .= '<option selected value="' . Html::escape($value) . '" >' . Html::escape($value) . '</option>'; + $html .= '<option selected value="' . e($value) . '" >' . e($value) . '</option>'; } foreach (['' => ''] + GedcomTag::getFileFormTypes() + [] as $typeName => $typeValue) { $html .= '<option value="' . $typeName . '" '; @@ -833,17 +833,17 @@ class FunctionsEdit { } elseif (($fact !== 'NAME' || $upperlevel === 'REPO' || $upperlevel === 'UNKNOWN') && $fact !== '_MARNM') { if ($fact === 'TEXT' || $fact === 'ADDR' || ($fact === 'NOTE' && !$islink)) { $html .= '<div class="input-group">'; - $html .= '<textarea class="form-control" id="' . $id . '" name="' . $name . '" dir="auto">' . Html::escape($value) . '</textarea>'; + $html .= '<textarea class="form-control" id="' . $id . '" name="' . $name . '" dir="auto">' . e($value) . '</textarea>'; $html .= self::inputAddonKeyboard($id); $html .= '</div>'; } else { // If using GEDFact-assistant window - $html .= '<input class="form-control" type="text" id="' . $id . '" name="' . $name . '" value="' . Html::escape($value) . '">'; + $html .= '<input class="form-control" type="text" id="' . $id . '" name="' . $name . '" value="' . e($value) . '">'; } } else { // Populated in javascript from sub-tags - $html .= '<input type="hidden" id="' . $id . '" name="' . $name . '" oninput="updateTextName(\'' . $id . '\')" value="' . Html::escape($value) . '" class="' . $fact . '">'; - $html .= '<span id="' . $id . '_display" dir="auto">' . Html::escape($value) . '</span>'; + $html .= '<input type="hidden" id="' . $id . '" name="' . $name . '" oninput="updateTextName(\'' . $id . '\')" value="' . e($value) . '" class="' . $fact . '">'; + $html .= '<span id="' . $id . '_display" dir="auto">' . e($value) . '</span>'; $html .= ' <a href="#edit_name" onclick="convertHidden(\'' . $id . '\'); return false" class="icon-edit_indi" title="' . I18N::translate('Edit the name') . '"></a>'; } // MARRiage TYPE : hide text field and show a selection list diff --git a/app/Functions/FunctionsPrint.php b/app/Functions/FunctionsPrint.php index 08f4fa99ba..f46d7c0343 100644 --- a/app/Functions/FunctionsPrint.php +++ b/app/Functions/FunctionsPrint.php @@ -496,7 +496,7 @@ class FunctionsPrint { echo '<td><form name="newFromClipboard" onsubmit="return false;">'; echo '<select id="newClipboardFact">'; } - echo '<option value="', Html::escape($fact_id), '">', GedcomTag::getLabel($fact['fact']); + echo '<option value="', e($fact_id), '">', GedcomTag::getLabel($fact['fact']); // TODO use the event class to store/parse the clipboard events if (preg_match('/^2 DATE (.+)/m', $fact['factrec'], $match)) { $tmp = new Date($match[1]); diff --git a/app/Functions/FunctionsPrintFacts.php b/app/Functions/FunctionsPrintFacts.php index 29512f8762..09bba9b3ae 100644 --- a/app/Functions/FunctionsPrintFacts.php +++ b/app/Functions/FunctionsPrintFacts.php @@ -142,7 +142,7 @@ class FunctionsPrintFacts { $type = ''; // Do not print this again } elseif ($type) { // We don't have a translation for $type - but a custom translation might exist. - $label = I18N::translate(Html::escape($type)); + $label = I18N::translate(e($type)); $type = ''; // Do not print this again } else { // An unspecified fact/event @@ -221,7 +221,7 @@ class FunctionsPrintFacts { echo $fact->getValue(); break; case 'AFN': - echo '<div class="field"><a href="https://familysearch.org/search/tree/results#count=20&query=afn:', rawurlencode($fact->getValue()), '">', Html::escape($fact->getValue()), '</a></div>'; + echo '<div class="field"><a href="https://familysearch.org/search/tree/results#count=20&query=afn:', rawurlencode($fact->getValue()), '">', e($fact->getValue()), '</a></div>'; break; case 'ASSO': // we handle this later, in format_asso_rela_record() @@ -229,7 +229,7 @@ class FunctionsPrintFacts { case 'EMAIL': case 'EMAI': case '_EMAIL': - echo '<div class="field"><a href="mailto:', Html::escape($fact->getValue()), '">', Html::escape($fact->getValue()), '</a></div>'; + echo '<div class="field"><a href="mailto:', e($fact->getValue()), '">', e($fact->getValue()), '</a></div>'; break; case 'RESN': echo '<div class="field">'; @@ -249,7 +249,7 @@ class FunctionsPrintFacts { echo '<i class="icon-locked-none"></i> ', I18N::translate('Only managers can edit'); break; default: - echo Html::escape($fact->getValue()); + echo e($fact->getValue()); break; } echo '</div>'; @@ -261,16 +261,16 @@ class FunctionsPrintFacts { if (preg_match('/^@(' . WT_REGEX_XREF . ')@$/', $fact->getValue(), $match)) { self::printRepositoryRecord($match[1]); } else { - echo '<div class="error">', Html::escape($fact->getValue()), '</div>'; + echo '<div class="error">', e($fact->getValue()), '</div>'; } break; case 'URL': case '_URL': case 'WWW': - echo '<div class="field"><a href="', Html::escape($fact->getValue()), '">', Html::escape($fact->getValue()), '</a></div>'; + echo '<div class="field"><a href="', e($fact->getValue()), '">', e($fact->getValue()), '</a></div>'; break; case 'TEXT': // 0 SOUR / 1 TEXT - echo '<div class="field">', nl2br(Html::escape($fact->getValue()), false), '</div>'; + echo '<div class="field">', nl2br(e($fact->getValue()), false), '</div>'; break; default: // Display the value for all other facts/events @@ -291,10 +291,10 @@ class FunctionsPrintFacts { if ($target) { echo '<div><a href="', e($target->url()), '">', $target->getFullName(), '</a></div>'; } else { - echo '<div class="error">', Html::escape($fact->getValue()), '</div>'; + echo '<div class="error">', e($fact->getValue()), '</div>'; } } else { - echo '<div class="field"><span dir="auto">', Html::escape($fact->getValue()), '</span></div>'; + echo '<div class="field"><span dir="auto">', e($fact->getValue()), '</span></div>'; } break; } @@ -312,7 +312,7 @@ class FunctionsPrintFacts { // Allow (custom) translations for other types $type = I18N::translate($type); } - echo GedcomTag::getLabelValue('TYPE', Html::escape($type)); + echo GedcomTag::getLabelValue('TYPE', e($type)); } // Print the date of this fact/event @@ -398,7 +398,7 @@ class FunctionsPrintFacts { if ($user) { echo GedcomTag::getLabelValue('_WT_USER', $user->getRealNameHtml()); } else { - echo GedcomTag::getLabelValue('_WT_USER', Html::escape($match[2])); + echo GedcomTag::getLabelValue('_WT_USER', e($match[2])); } break; case 'RESN': @@ -418,7 +418,7 @@ class FunctionsPrintFacts { echo GedcomTag::getLabelValue('RESN', '<i class="icon-resn-locked"></i> ' . I18N::translate('Only managers can edit')); break; default: - echo GedcomTag::getLabelValue('RESN', Html::escape($match[2])); + echo GedcomTag::getLabelValue('RESN', e($match[2])); break; } break; @@ -434,7 +434,7 @@ class FunctionsPrintFacts { case 'URL': case '_URL': case 'WWW': - $link = '<a href="' . Html::escape($match[2]) . '">' . Html::escape($match[2]) . '</a>'; + $link = '<a href="' . e($match[2]) . '">' . e($match[2]) . '</a>'; echo GedcomTag::getLabelValue($fact->getTag() . ':' . $match[1], $link); break; default: @@ -446,11 +446,11 @@ class FunctionsPrintFacts { $link = '<a href="' . e($linked_record->url()) . '">' . $linked_record->getFullName() . '</a>'; echo GedcomTag::getLabelValue($fact->getTag() . ':' . $match[1], $link); } else { - echo GedcomTag::getLabelValue($fact->getTag() . ':' . $match[1], Html::escape($match[2])); + echo GedcomTag::getLabelValue($fact->getTag() . ':' . $match[1], e($match[2])); } } else { // Non links - echo GedcomTag::getLabelValue($fact->getTag() . ':' . $match[1], Html::escape($match[2])); + echo GedcomTag::getLabelValue($fact->getTag() . ':' . $match[1], e($match[2])); } } break; @@ -571,7 +571,7 @@ class FunctionsPrintFacts { $ct = preg_match_all('/' . $level . ' SOUR (.*)((?:\n\d CONT.*)*)/', $factrec, $match, PREG_SET_ORDER); for ($j = 0; $j < $ct; $j++) { if (strpos($match[$j][1], '@') === false) { - $source = Html::escape($match[$j][1] . preg_replace('/\n\d CONT ?/', "\n", $match[$j][2])); + $source = e($match[$j][1] . preg_replace('/\n\d CONT ?/', "\n", $match[$j][2])); $data .= '<div class="fact_SOUR"><span class="label">' . I18N::translate('Source') . ':</span> <span class="field" dir="auto">' . Filter::formatText($source, $WT_TREE) . '</span></div>'; } } @@ -866,9 +866,9 @@ class FunctionsPrintFacts { } if ($textSOUR['EVEN']) { - $html .= GedcomTag::getLabelValue('EVEN', Html::escape($textSOUR['EVEN'])); + $html .= GedcomTag::getLabelValue('EVEN', e($textSOUR['EVEN'])); if ($textSOUR['ROLE']) { - $html .= GedcomTag::getLabelValue('ROLE', Html::escape($textSOUR['ROLE'])); + $html .= GedcomTag::getLabelValue('ROLE', e($textSOUR['ROLE'])); } } diff --git a/app/Functions/FunctionsPrintLists.php b/app/Functions/FunctionsPrintLists.php index 1d87793540..59b5545ea4 100644 --- a/app/Functions/FunctionsPrintLists.php +++ b/app/Functions/FunctionsPrintLists.php @@ -312,7 +312,7 @@ class FunctionsPrintLists { // Extract Given names and Surnames for sorting list($surn_givn, $givn_surn) = self::sortableNames($individual); - $html .= '<td colspan="2" data-sort="' . Html::escape($givn_surn) . '">'; + $html .= '<td colspan="2" data-sort="' . e($givn_surn) . '">'; foreach ($individual->getAllNames() as $num => $name) { if ($name['type'] == 'NAME') { $title = ''; @@ -332,7 +332,7 @@ class FunctionsPrintLists { $html .= '</td>'; // Hidden column for sortable name - $html .= '<td hidden data-sort="' . Html::escape($surn_givn) . '"></td>'; + $html .= '<td hidden data-sort="' . e($surn_givn) . '"></td>'; // SOSA $html .= '<td class="center" data-sort="' . $key . '">'; @@ -732,7 +732,7 @@ class FunctionsPrintLists { // Extract Given names and Surnames for sorting list($surn_givn, $givn_surn) = self::sortableNames($husb); - $html .= '<td colspan="2" data-sort="' . Html::escape($givn_surn) . '">'; + $html .= '<td colspan="2" data-sort="' . e($givn_surn) . '">'; foreach ($husb->getAllNames() as $num => $name) { if ($name['type'] == 'NAME') { $title = ''; @@ -756,7 +756,7 @@ class FunctionsPrintLists { $html .= '</td>'; // Hidden column for sortable name - $html .= '<td hidden data-sort="' . Html::escape($surn_givn) . '"></td>'; + $html .= '<td hidden data-sort="' . e($surn_givn) . '"></td>'; // Husband age $mdate = $family->getMarriageDate(); @@ -775,7 +775,7 @@ class FunctionsPrintLists { // Wife name(s) // Extract Given names and Surnames for sorting list($surn_givn, $givn_surn) = self::sortableNames($wife); - $html .= '<td colspan="2" data-sort="' . Html::escape($givn_surn) . '">'; + $html .= '<td colspan="2" data-sort="' . e($givn_surn) . '">'; foreach ($wife->getAllNames() as $num => $name) { if ($name['type'] == 'NAME') { $title = ''; @@ -799,7 +799,7 @@ class FunctionsPrintLists { $html .= '</td>'; // Hidden column for sortable name - $html .= '<td hidden data-sort="' . Html::escape($surn_givn) . '"></td>'; + $html .= '<td hidden data-sort="' . e($surn_givn) . '"></td>'; // Wife age $mdate = $family->getMarriageDate(); @@ -979,7 +979,7 @@ class FunctionsPrintLists { } $html .= '<tr' . $class . '>'; // Source name(s) - $html .= '<td data-sort="' . Html::escape($source->getSortName()) . '">'; + $html .= '<td data-sort="' . e($source->getSortName()) . '">'; foreach ($source->getAllNames() as $n => $name) { if ($n) { $html .= '<br>'; @@ -998,7 +998,7 @@ class FunctionsPrintLists { } else { $author = ''; } - $html .= '<td data-sort="' . Html::escape($author) . '">' . $author . '</td>'; + $html .= '<td data-sort="' . e($author) . '">' . $author . '</td>'; $key = $source->getXref() . '@' . $source->getTree()->getTreeId(); // Count of linked individuals $num = array_key_exists($key, $count_individuals) ? $count_individuals[$key] : 0; @@ -1069,7 +1069,7 @@ class FunctionsPrintLists { } $html .= '<tr' . $class . '>'; // Count of linked notes - $html .= '<td data-sort="' . Html::escape($note->getSortName()) . '"><a class="name2" href="' . e($note->url()) . '">' . $note->getFullName() . '</a></td>'; + $html .= '<td data-sort="' . e($note->getSortName()) . '"><a class="name2" href="' . e($note->url()) . '">' . $note->getFullName() . '</a></td>'; $key = $note->getXref() . '@' . $note->getTree()->getTreeId(); // Count of linked individuals $num = array_key_exists($key, $count_individuals) ? $count_individuals[$key] : 0; @@ -1128,7 +1128,7 @@ class FunctionsPrintLists { } $html .= '<tr' . $class . '>'; // Repository name(s) - $html .= '<td data-sort="' . Html::escape($repository->getSortName()) . '">'; + $html .= '<td data-sort="' . e($repository->getSortName()) . '">'; foreach ($repository->getAllNames() as $n => $name) { if ($n) { $html .= '<br>'; @@ -1214,7 +1214,7 @@ class FunctionsPrintLists { } $html .= '</td>'; // Media object name(s) - $html .= '<td data-sort="' . Html::escape($media_object->getSortName()) . '">'; + $html .= '<td data-sort="' . e($media_object->getSortName()) . '">'; $html .= '<a href="' . e($media_object->url()) . '" class="list_item name2">' . $name . '</a>'; $html .= '</td>'; @@ -1273,14 +1273,14 @@ class FunctionsPrintLists { } $html .= '<tr>'; // Surname - $html .= '<td data-sort="' . Html::escape($surn) . '">'; + $html .= '<td data-sort="' . e($surn) . '">'; // Multiple surname variants, e.g. von Groot, van Groot, van der Groot, etc. foreach ($surns as $spfxsurn => $indis) { if ($spfxsurn) { - $html .= '<a href="' . $url . '" dir="auto">' . Html::escape($spfxsurn) . '</a><br>'; + $html .= '<a href="' . $url . '" dir="auto">' . e($spfxsurn) . '</a><br>'; } else { // No surname, but a value from "2 SURN"? A common workaround for toponyms, etc. - $html .= '<a href="' . $url . '" dir="auto">' . Html::escape($surn) . '</a><br>'; + $html .= '<a href="' . $url . '" dir="auto">' . e($surn) . '</a><br>'; } } $html .= '</td>'; @@ -1380,7 +1380,7 @@ class FunctionsPrintLists { $first_spfxsurn = $spfxsurn; } } - $subhtml = '<a href="' . $url . '" dir="auto">' . Html::escape(implode(I18N::$list_separator, array_keys($surns))) . '</a>'; + $subhtml = '<a href="' . $url . '" dir="auto">' . e(implode(I18N::$list_separator, array_keys($surns))) . '</a>'; if ($totals) { $subtotal = 0; @@ -1502,7 +1502,7 @@ class FunctionsPrintLists { foreach ($filtered_events as $n => $fact) { $record = $fact->getParent(); $html .= '<tr>'; - $html .= '<td data-sort="' . Html::escape($record->getSortName()) . '">'; + $html .= '<td data-sort="' . e($record->getSortName()) . '">'; $html .= '<a href="' . e($record->url()) . '">' . $record->getFullName() . '</a>'; if ($record instanceof Individual) { $html .= $record->getSexImage(); diff --git a/app/GedcomRecord.php b/app/GedcomRecord.php index 6c44b71f70..f944ed2b4f 100644 --- a/app/GedcomRecord.php +++ b/app/GedcomRecord.php @@ -538,7 +538,7 @@ class GedcomRecord { 'sort' => preg_replace_callback('/([0-9]+)/', function ($matches) { return str_pad($matches[0], 10, '0', STR_PAD_LEFT); }, $value), - 'full' => '<span dir="auto">' . Html::escape($value) . '</span>', // This is used for display + 'full' => '<span dir="auto">' . e($value) . '</span>', // This is used for display 'fullNN' => $value, // This goes into the database ]; } @@ -614,7 +614,7 @@ class GedcomRecord { * @return string */ public function getFallBackName() { - return Html::escape($this->getXref()); + return e($this->getXref()); } /** diff --git a/app/GedcomTag.php b/app/GedcomTag.php index 5348d44672..ce168ba9a9 100644 --- a/app/GedcomTag.php +++ b/app/GedcomTag.php @@ -1383,7 +1383,7 @@ class GedcomTag { } // Still no translation? Highlight this as an error - return '<span class="error" title="' . I18N::translate('Unrecognized GEDCOM code') . '">' . Html::escape($tag) . '</span>'; + return '<span class="error" title="' . I18N::translate('Unrecognized GEDCOM code') . '">' . e($tag) . '</span>'; } } diff --git a/app/Helpers/functions.php b/app/Helpers/functions.php index d7f6e29d35..6f44ca4e32 100644 --- a/app/Helpers/functions.php +++ b/app/Helpers/functions.php @@ -45,7 +45,7 @@ function csrf_token() { * @return string */ function e(string $text): string { - return Html::escape($text); + return e($text); } /** diff --git a/app/Http/Controllers/AdminController.php b/app/Http/Controllers/AdminController.php index 753df436ee..4a2315c20d 100644 --- a/app/Http/Controllers/AdminController.php +++ b/app/Http/Controllers/AdminController.php @@ -568,15 +568,15 @@ class AdminController extends BaseController { if (File::delete(WT_DATA_DIR . $path)) { if ($is_dir) { - FlashMessages::addMessage(I18N::translate('The folder %s has been deleted.', Html::escape($path)), 'success'); + FlashMessages::addMessage(I18N::translate('The folder %s has been deleted.', e($path)), 'success'); } else { - FlashMessages::addMessage(I18N::translate('The file %s has been deleted.', Html::escape($path)), 'success'); + FlashMessages::addMessage(I18N::translate('The file %s has been deleted.', e($path)), 'success'); } } else { if ($is_dir) { - FlashMessages::addMessage(I18N::translate('The folder %s could not be deleted.', Html::escape($path)), 'danger'); + FlashMessages::addMessage(I18N::translate('The folder %s could not be deleted.', e($path)), 'danger'); } else { - FlashMessages::addMessage(I18N::translate('The file %s could not be deleted.', Html::escape($path)), 'danger'); + FlashMessages::addMessage(I18N::translate('The file %s could not be deleted.', e($path)), 'danger'); } } } @@ -992,8 +992,8 @@ class AdminController extends BaseController { return [ $tree->getName(), $media->displayImage(100, 100, 'fit', ['class' => 'img-thumbnail']), - '<a href="' . Html::escape($media->url()) . '">' . $media->getFullName() . '</a>', - '<a href="' . Html::escape($individual->url()) . '">' . $individual->getFullName() . '</a>', + '<a href="' . e($media->url()) . '">' . $media->getFullName() . '</a>', + '<a href="' . e($individual->url()) . '">' . $individual->getFullName() . '</a>', implode(' ', $facts), ]; }, $data); @@ -1176,7 +1176,7 @@ class AdminController extends BaseController { public function mergeRecords(Request $request): Response { /** @var Tree $tree */ $tree = $request->attributes->get('tree'); - $title = I18N::translate('Merge records') . ' — ' . Html::escape($tree->getTitle()); + $title = I18N::translate('Merge records') . ' — ' . e($tree->getTitle()); $xref1 = $request->get('xref1', ''); $xref2 = $request->get('xref2', ''); @@ -1461,7 +1461,7 @@ class AdminController extends BaseController { public function treePrivacyEdit(Request $request): Response { /** @var Tree $tree */ $tree = $request->attributes->get('tree'); - $title = Html::escape($tree->getName()) . ' — ' . I18N::translate('Privacy'); + $title = e($tree->getName()) . ' — ' . I18N::translate('Privacy'); $all_tags = $this->tagsForPrivacy($tree); $privacy_constants = $this->privacyConstants(); $privacy_restrictions = $this->privacyRestrictions($tree); @@ -1542,14 +1542,14 @@ class AdminController extends BaseController { $tree->setPreference('SHOW_LIVING_NAMES', $request->get('SHOW_LIVING_NAMES')); $tree->setPreference('SHOW_PRIVATE_RELATIONSHIPS', $request->get('SHOW_PRIVATE_RELATIONSHIPS')); - FlashMessages::addMessage(I18N::translate('The preferences for the family tree “%s” have been updated.', Html::escape($tree->getTitle()), 'success')); + FlashMessages::addMessage(I18N::translate('The preferences for the family tree “%s” have been updated.', e($tree->getTitle()), 'success')); // Coming soon... if ((bool) $request->get('all_trees')) { - FlashMessages::addMessage(I18N::translate('The preferences for all family trees have been updated.', Html::escape($tree->getTitle())), 'success'); + FlashMessages::addMessage(I18N::translate('The preferences for all family trees have been updated.', e($tree->getTitle())), 'success'); } if ((bool) $request->get('new_trees')) { - FlashMessages::addMessage(I18N::translate('The preferences for new family trees have been updated.', Html::escape($tree->getTitle())), 'success'); + FlashMessages::addMessage(I18N::translate('The preferences for new family trees have been updated.', e($tree->getTitle())), 'success'); } diff --git a/app/Http/Controllers/HomePageController.php b/app/Http/Controllers/HomePageController.php index 46f720675f..c36dac1639 100644 --- a/app/Http/Controllers/HomePageController.php +++ b/app/Http/Controllers/HomePageController.php @@ -49,7 +49,7 @@ class HomePageController extends BaseController { $access_level = Auth::accessLevel($tree); $main_blocks = $this->getBlocksForTreePage($tree_id, $access_level, 'main'); $side_blocks = $this->getBlocksForTreePage($tree_id, $access_level, 'side'); - $title = Html::escape($tree->getTitle()); + $title = e($tree->getTitle()); // @TODO - ModuleBlockInterface::getBlock() currently relies on these globals global $WT_TREE, $ctype, $controller; @@ -391,7 +391,7 @@ class HomePageController extends BaseController { $main_blocks = $this->getBlocksForUserPage(-1, $user_id, Auth::PRIV_NONE, 'main'); $side_blocks = $this->getBlocksForUserPage(-1, $user_id, Auth::PRIV_NONE, 'side'); $all_blocks = $this->getAvailableUserBlocks(); - $title = I18N::translate('Change the blocks on this user’s “My page”') . ' - ' . Html::escape($user->getUserName()); + $title = I18N::translate('Change the blocks on this user’s “My page”') . ' - ' . e($user->getUserName()); $url_cancel = Html::url('admin_users.php', []); $url_save = route('user-page-user-update', ['user_id' => $user_id]); diff --git a/app/Http/Controllers/SetupController.php b/app/Http/Controllers/SetupController.php index 3275ddd2c0..fdc09bc990 100644 --- a/app/Http/Controllers/SetupController.php +++ b/app/Http/Controllers/SetupController.php @@ -171,7 +171,7 @@ class SetupController extends BaseController { } catch (PDOException $ex) { DebugBar::addThrowable($ex); - return I18N::translate('Unable to connect using this username and password. Your server gave the following error.') . '<br><br>' . Html::escape($ex->getMessage()) . '<br><br>' . I18N::translate('Check the settings and try again.'); + return I18N::translate('Unable to connect using this username and password. Your server gave the following error.') . '<br><br>' . e($ex->getMessage()) . '<br><br>' . I18N::translate('Check the settings and try again.'); } return ''; @@ -217,7 +217,7 @@ class SetupController extends BaseController { } catch (PDOException $ex) { DebugBar::addThrowable($ex); - return I18N::translate('Unable to connect using this username and password. Your server gave the following error.') . '<br><br>' . Html::escape($ex->getMessage()) . '<br><br>' . I18N::translate('Check the settings and try again.'); + return I18N::translate('Unable to connect using this username and password. Your server gave the following error.') . '<br><br>' . e($ex->getMessage()) . '<br><br>' . I18N::translate('Check the settings and try again.'); } return ''; @@ -405,7 +405,7 @@ class SetupController extends BaseController { $errors = []; if (!$this->checkFolderIsWritable(WT_DATA_DIR)) { - $errors[] = '<code>' . Html::escape(realpath(WT_DATA_DIR)) . '</code><br>' . I18N::translate('Oops! webtrees was unable to create files in this folder.') . '<br>' . I18N::translate('This usually means that you need to change the folder permissions to 777.') . '<br>' . I18N::translate('You must change this before you can continue.'); + $errors[] = '<code>' . e(realpath(WT_DATA_DIR)) . '</code><br>' . I18N::translate('Oops! webtrees was unable to create files in this folder.') . '<br>' . I18N::translate('This usually means that you need to change the folder permissions to 777.') . '<br>' . I18N::translate('You must change this before you can continue.'); } foreach ($extensions as $extension) { diff --git a/app/Individual.php b/app/Individual.php index 43fc193499..edaa976d3c 100644 --- a/app/Individual.php +++ b/app/Individual.php @@ -521,8 +521,8 @@ class Individual extends GedcomRecord { return /* I18N: A range of years, e.g. “1870–”, “1870–1920”, “–1920” */ I18N::translate( '%1$s–%2$s', - '<span title="' . Html::escape($birth_place) . ' ' . $birth_date . '">' . $this->getBirthYear() . '</span>', - '<span title="' . Html::escape($death_place) . ' ' . $death_date . '">' . $this->getDeathYear() . '</span>' + '<span title="' . e($birth_place) . ' ' . $birth_date . '">' . $this->getBirthYear() . '</span>', + '<span title="' . e($death_place) . ' ' . $death_date . '">' . $this->getDeathYear() . '</span>' ); } @@ -1180,7 +1180,7 @@ class Individual extends GedcomRecord { $full = str_replace('@N.N.', I18N::translateContext('Unknown surname', '…'), $full); $full = str_replace('@P.N.', I18N::translateContext('Unknown given name', '…'), $full); // Format for display - $full = '<span class="NAME" dir="auto" translate="no">' . preg_replace('/\/([^\/]*)\//', '<span class="SURN">$1</span>', Html::escape($full)) . '</span>'; + $full = '<span class="NAME" dir="auto" translate="no">' . preg_replace('/\/([^\/]*)\//', '<span class="SURN">$1</span>', e($full)) . '</span>'; // Localise quotation marks around the nickname $full = preg_replace_callback('/"([^&]*)"/', function ($matches) { return I18N::translate('“%s”', $matches[1]); diff --git a/app/Menu.php b/app/Menu.php index 727154bffd..0091ac7cea 100644 --- a/app/Menu.php +++ b/app/Menu.php @@ -69,7 +69,7 @@ class Menu { foreach ($this->submenus as $submenu) { $attrs = ''; foreach ($submenu->attrs as $key => $value) { - $attrs .= ' ' . $key . '="' . Html::escape($value) . '"'; + $attrs .= ' ' . $key . '="' . e($value) . '"'; } $class = trim('dropdown-item ' . $submenu->class); @@ -90,7 +90,7 @@ class Menu { } else { $attrs = ''; foreach ($this->attrs as $key => $value) { - $attrs .= ' ' . $key . '="' . Html::escape($value) . '"'; + $attrs .= ' ' . $key . '="' . e($value) . '"'; } $class = trim('nav-item ' . $this->class); @@ -219,7 +219,7 @@ class Menu { public function getMenuAsList() { $attrs = ''; foreach ($this->attrs as $key => $value) { - $attrs .= ' ' . $key . '="' . Html::escape($value) . '"'; + $attrs .= ' ' . $key . '="' . e($value) . '"'; } if ($this->link) { $link = ' href="' . $this->link . '"'; diff --git a/app/Module/BatchUpdate/BatchUpdateSearchReplacePlugin.php b/app/Module/BatchUpdate/BatchUpdateSearchReplacePlugin.php index 364c25cd9f..5a2bb2c43f 100644 --- a/app/Module/BatchUpdate/BatchUpdateSearchReplacePlugin.php +++ b/app/Module/BatchUpdate/BatchUpdateSearchReplacePlugin.php @@ -18,7 +18,6 @@ namespace Fisharebest\Webtrees\Module\BatchUpdate; use Fisharebest\Webtrees\Bootstrap4; use Fisharebest\Webtrees\DebugBar; use Fisharebest\Webtrees\Filter; -use Fisharebest\Webtrees\Html; use Fisharebest\Webtrees\I18N; /** @@ -150,13 +149,13 @@ class BatchUpdateSearchReplacePlugin extends BatchUpdateBasePlugin { '<div class="row form-group">' . '<label class="col-sm-3 col-form-label">' . I18N::translate('Search text/pattern') . '</label>' . '<div class="col-sm-9">' . - '<input class="form-control" name="search" size="40" value="' . Html::escape($this->search) . + '<input class="form-control" name="search" size="40" value="' . e($this->search) . '" onchange="this.form.submit();">' . '</div></div>' . '<div class="row form-group">' . '<label class="col-sm-3 col-form-label">' . I18N::translate('Replacement text') . '</label>' . '<div class="col-sm-9">' . - '<input class="form-control" name="replace" size="40" value="' . Html::escape($this->replace) . + '<input class="form-control" name="replace" size="40" value="' . e($this->replace) . '" onchange="this.form.submit();"></td></tr>' . '</div></div>' . '<div class="row form-group">' . diff --git a/app/Module/BatchUpdateModule.php b/app/Module/BatchUpdateModule.php index d97629d38b..62e1c3a397 100644 --- a/app/Module/BatchUpdateModule.php +++ b/app/Module/BatchUpdateModule.php @@ -391,9 +391,9 @@ class BatchUpdateModule extends AbstractModule implements ModuleConfigInterface public static function createSubmitButton($text, $xref, $action = '', $data = '') { return '<input class="btn btn-primary" type="submit" value="' . $text . '" onclick="' . - 'this.form.xref.value=\'' . Html::escape($xref) . '\';' . - 'this.form.action.value=\'' . Html::escape($action) . '\';' . - 'this.form.data.value=\'' . Html::escape($data) . '\';' . + 'this.form.xref.value=\'' . e($xref) . '\';' . + 'this.form.action.value=\'' . e($action) . '\';' . + 'this.form.data.value=\'' . e($data) . '\';' . 'return true;"' . ($xref ? '' : ' disabled') . '>'; } diff --git a/app/Module/CensusAssistantModule.php b/app/Module/CensusAssistantModule.php index f3b84f8298..c208b97e82 100644 --- a/app/Module/CensusAssistantModule.php +++ b/app/Module/CensusAssistantModule.php @@ -244,7 +244,7 @@ class CensusAssistantModule extends AbstractModule { echo '<td class="list_value_wrap"><ul>'; usort($myindilist, '\Fisharebest\Webtrees\GedcomRecord::compare'); foreach ($myindilist as $indi) { - $nam = Html::escape($indi->getFullName()); + $nam = e($indi->getFullName()); echo "<li><a href=\"#\" onclick=\"pasterow( '" . $indi->getXref() . "' , '" . $nam . "' , diff --git a/app/Module/FamiliesSidebarModule.php b/app/Module/FamiliesSidebarModule.php index 31465f7548..f62cc004b7 100644 --- a/app/Module/FamiliesSidebarModule.php +++ b/app/Module/FamiliesSidebarModule.php @@ -186,7 +186,7 @@ class FamiliesSidebarModule extends AbstractModule implements ModuleSidebarInter $surnames = QueryName::surnames($tree, '', $alpha, true, true); $out = '<ul>'; foreach (array_keys($surnames) as $surname) { - $out .= '<li class="sb_fam_surname_li"><a href="#" data-surname="' . Html::escape($surname) . '" data-alpha="' . Html::escape($alpha) . '" class="sb_fam_surname">' . Html::escape($surname) . '</a>'; + $out .= '<li class="sb_fam_surname_li"><a href="#" data-surname="' . e($surname) . '" data-alpha="' . e($alpha) . '" class="sb_fam_surname">' . e($surname) . '</a>'; $out .= '<div class="name_tree_div"></div>'; $out .= '</li>'; } diff --git a/app/Module/FamilyTreeNewsModule.php b/app/Module/FamilyTreeNewsModule.php index 34fdeefc4d..ddb84836da 100644 --- a/app/Module/FamilyTreeNewsModule.php +++ b/app/Module/FamilyTreeNewsModule.php @@ -102,7 +102,7 @@ class FamilyTreeNewsModule extends AbstractModule implements ModuleBlockInterfac foreach ($articles as $article) { $content .= '<div class="news_box">'; - $content .= '<div class="news_title">' . Html::escape($article->subject) . '</div>'; + $content .= '<div class="news_title">' . e($article->subject) . '</div>'; $content .= '<div class="news_date">' . FunctionsDate::formatTimestamp($article->updated) . '</div>'; if ($article->body == strip_tags($article->body)) { $article->body = nl2br($article->body, false); @@ -112,7 +112,7 @@ class FamilyTreeNewsModule extends AbstractModule implements ModuleBlockInterfac $content .= '<hr>'; $content .= '<a href="editnews.php?news_id=' . $article->news_id . '&ctype=gedcom&ged=' . $WT_TREE->getNameHtml() . '">' . I18N::translate('Edit') . '</a>'; $content .= ' | '; - $content .= '<a href="editnews.php?action=delete&news_id=' . $article->news_id . '&ctype=gedcom&ged=' . $WT_TREE->getNameHtml() . '" onclick="return confirm(\'' . I18N::translate('Are you sure you want to delete “%s”?', Html::escape($article->subject)) . "');\">" . I18N::translate('Delete') . '</a><br>'; + $content .= '<a href="editnews.php?action=delete&news_id=' . $article->news_id . '&ctype=gedcom&ged=' . $WT_TREE->getNameHtml() . '" onclick="return confirm(\'' . I18N::translate('Are you sure you want to delete “%s”?', e($article->subject)) . "');\">" . I18N::translate('Delete') . '</a><br>'; } $content .= '</div>'; } diff --git a/app/Module/FamilyTreeStatisticsModule.php b/app/Module/FamilyTreeStatisticsModule.php index db65aee4ad..b764043238 100644 --- a/app/Module/FamilyTreeStatisticsModule.php +++ b/app/Module/FamilyTreeStatisticsModule.php @@ -265,7 +265,7 @@ class FamilyTreeStatisticsModule extends AbstractModule implements ModuleBlockIn pattern="[1-9][0-9]*" required type="text" - value="<?= Html::escape($number_of_surnames) ?>" + value="<?= e($number_of_surnames) ?>" > </label> </div> diff --git a/app/Module/FrequentlyAskedQuestionsModule.php b/app/Module/FrequentlyAskedQuestionsModule.php index 923d5543ce..bd2af0d524 100644 --- a/app/Module/FrequentlyAskedQuestionsModule.php +++ b/app/Module/FrequentlyAskedQuestionsModule.php @@ -181,7 +181,7 @@ class FrequentlyAskedQuestionsModule extends AbstractModule implements ModuleMen <div class="col-sm-9"> <input type="text" class="form-control" name="header" id="header" - value="<?= Html::escape($header) ?>"> + value="<?= e($header) ?>"> </div> </div> @@ -191,7 +191,7 @@ class FrequentlyAskedQuestionsModule extends AbstractModule implements ModuleMen </label> <div class="col-sm-9"> - <textarea name="faqbody" id="faqbody" class="form-control html-edit" rows="10"><?= Html::escape($faqbody) ?></textarea> + <textarea name="faqbody" id="faqbody" class="form-control html-edit" rows="10"><?= e($faqbody) ?></textarea> </div> </div> @@ -495,7 +495,7 @@ class FrequentlyAskedQuestionsModule extends AbstractModule implements ModuleMen echo '</td><td>'; echo '<a href="module.php?mod=', $this->getName(), '&mod_action=admin_edit&block_id=', $faq->block_id, '"><i class="fas fa-pencil-alt"></i> ', I18N::translate('Edit'), '</a>'; echo '</td><td>'; - echo '<a href="module.php?mod=', $this->getName(), '&mod_action=admin_delete&block_id=', $faq->block_id, '" onclick="return confirm(\'', I18N::translate('Are you sure you want to delete “%s”?', Html::escape($faq->header)), '\');"><i class="fas fa-trash-alt"></i> ', I18N::translate('Delete'), '</a>'; + echo '<a href="module.php?mod=', $this->getName(), '&mod_action=admin_delete&block_id=', $faq->block_id, '" onclick="return confirm(\'', I18N::translate('Are you sure you want to delete “%s”?', e($faq->header)), '\');"><i class="fas fa-trash-alt"></i> ', I18N::translate('Delete'), '</a>'; echo '</td></tr>'; // NOTE: Print the title text of the current item echo '<tr><td colspan="5">'; diff --git a/app/Module/GoogleMapsModule.php b/app/Module/GoogleMapsModule.php index 88c44a415f..e2dd6b276b 100644 --- a/app/Module/GoogleMapsModule.php +++ b/app/Module/GoogleMapsModule.php @@ -1354,7 +1354,7 @@ class GoogleMapsModule extends AbstractModule implements ModuleConfigInterface, echo '</th>'; echo '<td>'; if ($event['info']) { - echo '<div><span class="field">', Html::escape($event['info']), '</span></div>'; + echo '<div><span class="field">', e($event['info']), '</span></div>'; } if ($event['name']) { echo '<div>', $event['name'], '</div>'; @@ -1777,7 +1777,7 @@ class GoogleMapsModule extends AbstractModule implements ModuleConfigInterface, if ($place2->pl_place === 'Unknown') { echo I18N::translate('unknown'); } else { - echo Html::escape($place2->pl_place); + echo e($place2->pl_place); } echo '</a>'; $parent[$level] = $place2->pl_place; @@ -2194,7 +2194,7 @@ class GoogleMapsModule extends AbstractModule implements ModuleConfigInterface, <?php foreach ($placefiles as $p => $placefile) { unset($placefiles[$p]); - $p = Html::escape($placefile); + $p = e($placefile); if (substr($placefile, 0, 1) == '/') { $placefiles[$p] = substr($placefile, 1); } else { @@ -2624,7 +2624,7 @@ class GoogleMapsModule extends AbstractModule implements ModuleConfigInterface, [0 => I18N::translate('Geographic data')] + $this->placeIdToHierarchy($place_id === 0 ? $parent_id : $place_id); foreach ($hierarchy as $id => $name) { - $breadcrumbs += ['module.php?mod=googlemap&mod_action=admin_places&parent_id=' . $id . '&inactive=' . $inactive => Html::escape($name)]; + $breadcrumbs += ['module.php?mod=googlemap&mod_action=admin_places&parent_id=' . $id . '&inactive=' . $inactive => e($name)]; } echo Bootstrap4::breadcrumbs($breadcrumbs, $place_id === 0 ? I18N::translate('Add') : I18N::translate('Edit')); @@ -3021,7 +3021,7 @@ class GoogleMapsModule extends AbstractModule implements ModuleConfigInterface, <?= I18N::translate('Place') ?> </label> <div class="col-sm-6"> - <input type="text" id="new_pl_name" name="NEW_PLACE_NAME" value="<?= Html::escape($record->pl_place) ?>" class="form-control" required> + <input type="text" id="new_pl_name" name="NEW_PLACE_NAME" value="<?= e($record->pl_place) ?>" class="form-control" required> <label for="new_pl_name"> <a href="#" onclick="showLocation_all(document.getElementById('new_pl_name').value); return false"> @@ -3134,7 +3134,7 @@ class GoogleMapsModule extends AbstractModule implements ModuleConfigInterface, [0 => I18N::translate('Geographic data')] + $this->placeIdToHierarchy($parent_id); foreach (array_slice($hierarchy, 0, -1, true) as $id => $name) { - $breadcrumbs += ['module.php?mod=googlemap&mod_action=admin_places&parent_id=' . $id . '&inactive=' . $inactive => Html::escape($name)]; + $breadcrumbs += ['module.php?mod=googlemap&mod_action=admin_places&parent_id=' . $id . '&inactive=' . $inactive => e($name)]; } echo Bootstrap4::breadcrumbs($breadcrumbs, end($hierarchy)); @@ -3236,7 +3236,7 @@ class GoogleMapsModule extends AbstractModule implements ModuleConfigInterface, $highestIndex++; Database::prepare("INSERT INTO `##placelocation` (pl_id, pl_parent_id, pl_level, pl_place, pl_zoom) VALUES (?, ?, ?, ?, ?)") ->execute([$highestIndex, $parent_id, $i, $escparent, $default_zoom_level[$i]]); - echo Html::escape($escparent), '<br>'; + echo e($escparent), '<br>'; $parent_id = $highestIndex; } else { $parent_id = $row->pl_id; @@ -3247,12 +3247,12 @@ class GoogleMapsModule extends AbstractModule implements ModuleConfigInterface, $highestIndex++; Database::prepare("INSERT INTO `##placelocation` (pl_id, pl_parent_id, pl_level, pl_place, pl_long, pl_lati, pl_zoom) VALUES (?, ?, ?, ?, ?, ?, ?)") ->execute([$highestIndex, $parent_id, $i, $escparent, $place['long'], $place['lati'], $default_zoom_level[$i]]); - echo Html::escape($escparent), '<br>'; + echo e($escparent), '<br>'; } else { if (empty($row->pl_long) && empty($row->pl_lati) && $place['lati'] != '0' && $place['long'] != '0') { Database::prepare("UPDATE `##placelocation` SET pl_lati=?, pl_long=? WHERE pl_id=?") ->execute([$place['lati'], $place['long'], $row->pl_id]); - echo Html::escape($escparent), '<br>'; + echo e($escparent), '<br>'; } } } @@ -3296,7 +3296,7 @@ class GoogleMapsModule extends AbstractModule implements ModuleConfigInterface, <?php if ($place['place'] === 'Unknown'): ?> <?= I18N::translate('unknown') ?> <?php else: ?> - <?= Html::escape($place['place']) ?> + <?= e($place['place']) ?> <?php endif ?> <?php if ($place['missing'] > 0): ?> <span class="badge badge-pill badge-warning"> @@ -3320,7 +3320,7 @@ class GoogleMapsModule extends AbstractModule implements ModuleConfigInterface, </td> <td> <?php if ($place['icon']): ?> - <img src="<?= WT_MODULES_DIR ?>googlemap/places/flags/<?= Html::escape($place['icon']) ?>" width="25" height="15" title="<?= Html::escape($place['icon']) ?>" alt="<?= I18N::translate('Flag') ?>"> + <img src="<?= WT_MODULES_DIR ?>googlemap/places/flags/<?= e($place['icon']) ?>" width="25" height="15" title="<?= e($place['icon']) ?>" alt="<?= I18N::translate('Flag') ?>"> <?php else: ?> <img src="<?= WT_MODULES_DIR ?>googlemap/images/mm_20_red.png"> <?php endif ?> diff --git a/app/Module/HtmlBlockModule.php b/app/Module/HtmlBlockModule.php index 4fe20af244..9f10401735 100644 --- a/app/Module/HtmlBlockModule.php +++ b/app/Module/HtmlBlockModule.php @@ -265,7 +265,7 @@ class HtmlBlockModule extends AbstractModule implements ModuleBlockInterface { <?= I18N::translate('Title') ?> </label> <div class="col-sm-9"> - <input class="form-control" type="text" id="title" name="title" value="<?= Html::escape($title) ?>"> + <input class="form-control" type="text" id="title" name="title" value="<?= e($title) ?>"> </div> </div> @@ -302,7 +302,7 @@ class HtmlBlockModule extends AbstractModule implements ModuleBlockInterface { </div> <div class="row form-group"> - <textarea name="html" id="html" class="html-edit" rows="10"><?= Html::escape($html) ?></textarea> + <textarea name="html" id="html" class="html-edit" rows="10"><?= e($html) ?></textarea> </div> <fieldset class="form-group"> diff --git a/app/Module/IndividualSidebarModule.php b/app/Module/IndividualSidebarModule.php index 3367749d06..e192ae9886 100644 --- a/app/Module/IndividualSidebarModule.php +++ b/app/Module/IndividualSidebarModule.php @@ -186,7 +186,7 @@ class IndividualSidebarModule extends AbstractModule implements ModuleSidebarInt $surnames = QueryName::surnames($tree, '', $alpha, true, false); $out = '<ul>'; foreach (array_keys($surnames) as $surname) { - $out .= '<li class="sb_indi_surname_li"><a href="#" data-surname="' . Html::escape($surname) . '" data-alpha="' . Html::escape($alpha) . '" class="sb_indi_surname">' . Html::escape($surname) . '</a>'; + $out .= '<li class="sb_indi_surname_li"><a href="#" data-surname="' . e($surname) . '" data-alpha="' . e($alpha) . '" class="sb_indi_surname">' . e($surname) . '</a>'; $out .= '<div class="name_tree_div"></div>'; $out .= '</li>'; } diff --git a/app/Module/LoggedInUsersModule.php b/app/Module/LoggedInUsersModule.php index 31ff692587..e563ad28b2 100644 --- a/app/Module/LoggedInUsersModule.php +++ b/app/Module/LoggedInUsersModule.php @@ -86,7 +86,7 @@ class LoggedInUsersModule extends AbstractModule implements ModuleBlockInterface } else { $content .= $user->getRealNameHtml(); } - $content .= ' - ' . Html::escape($user->getUserName()); + $content .= ' - ' . e($user->getUserName()); if (Auth::id() != $user->getUserId() && $user->getPreference('contactmethod') != 'none') { $content .= FontAwesome::linkIcon('email', I18N::translate('Send a message'), ['class' => 'btn btn-link', 'href' => 'message.php?to=' . rawurlencode($user->getUserName()) . '&ged=' . $WT_TREE->getNameUrl()]); } diff --git a/app/Module/RecentChangesModule.php b/app/Module/RecentChangesModule.php index 4f2d5f5171..587bb789e8 100644 --- a/app/Module/RecentChangesModule.php +++ b/app/Module/RecentChangesModule.php @@ -232,7 +232,7 @@ class RecentChangesModule extends AbstractModule implements ModuleBlockInterface if ($timestamp !== '') { if ($show_user) { $html .= /* I18N: [a record was] Changed on <date/time> by <user> */ - I18N::translate('Changed on %1$s by %2$s', $timestamp, Html::escape($record->lastChangeUser())); + I18N::translate('Changed on %1$s by %2$s', $timestamp, e($record->lastChangeUser())); } else { $html .= /* I18N: [a record was] Changed on <date/time> */ I18N::translate('Changed on %1$s', $timestamp); @@ -325,7 +325,7 @@ class RecentChangesModule extends AbstractModule implements ModuleBlockInterface break; } $html .= '</td>'; - $html .= '<td data-sort="' . Html::escape($record->getSortName()) . '">'; + $html .= '<td data-sort="' . e($record->getSortName()) . '">'; $html .= '<a href="' . e($record->url()) . '">' . $record->getFullName() . '</a>'; $addname = $record->getAddName(); if ($addname) { @@ -333,7 +333,7 @@ class RecentChangesModule extends AbstractModule implements ModuleBlockInterface } $html .= '</td>'; $html .= '<td data-sort="' . $record->lastChangeTimestamp(true) . '">' . $record->lastChangeTimestamp() . '</td>'; - $html .= '<td>' . Html::escape($record->lastChangeUser()) . '</td>'; + $html .= '<td>' . e($record->lastChangeUser()) . '</td>'; $html .= '</tr>'; } diff --git a/app/Module/StoriesModule.php b/app/Module/StoriesModule.php index 7ae0530e98..4d30aa4d30 100644 --- a/app/Module/StoriesModule.php +++ b/app/Module/StoriesModule.php @@ -228,7 +228,7 @@ class StoriesModule extends AbstractModule implements ModuleTabInterface, Module <?= I18N::translate('Story title') ?> </label> <div class="col-sm-9"> - <input type="text" class="form-control" name="title" id="title" value="<?= Html::escape($title) ?>"> + <input type="text" class="form-control" name="title" id="title" value="<?= e($title) ?>"> </div> </div> @@ -237,7 +237,7 @@ class StoriesModule extends AbstractModule implements ModuleTabInterface, Module <?= I18N::translate('Story') ?> </label> <div class="col-sm-9"> - <textarea name="story_body" id="story_body" class="html-edit form-control" rows="10"><?= Html::escape($story_body) ?></textarea> + <textarea name="story_body" id="story_body" class="html-edit form-control" rows="10"><?= e($story_body) ?></textarea> </div> </div> @@ -374,7 +374,7 @@ class StoriesModule extends AbstractModule implements ModuleTabInterface, Module <?php foreach ($stories as $story): ?> <tr> <td> - <?= Html::escape($this->getBlockSetting($story->block_id, 'title')) ?> + <?= e($this->getBlockSetting($story->block_id, 'title')) ?> </td> <td> <?php $individual = Individual::getInstance($story->xref, $WT_TREE) ?> @@ -394,7 +394,7 @@ class StoriesModule extends AbstractModule implements ModuleTabInterface, Module <td> <a href="module.php?mod=<?= $this->getName() ?>&mod_action=admin_delete&block_id=<?= $story->block_id ?>" - onclick="return confirm('<?= I18N::translate('Are you sure you want to delete “%s”?', Html::escape($this->getBlockSetting($story->block_id, 'title'))) ?>');" + onclick="return confirm('<?= I18N::translate('Are you sure you want to delete “%s”?', e($this->getBlockSetting($story->block_id, 'title'))) ?>');" > <i class="fas fa-trash-alt"></i> <?= I18N::translate('Delete') ?> </a> diff --git a/app/Module/UserJournalModule.php b/app/Module/UserJournalModule.php index 4fcb21192e..c7ebc0ff3d 100644 --- a/app/Module/UserJournalModule.php +++ b/app/Module/UserJournalModule.php @@ -18,7 +18,6 @@ namespace Fisharebest\Webtrees\Module; use Fisharebest\Webtrees\Auth; use Fisharebest\Webtrees\Database; use Fisharebest\Webtrees\Functions\FunctionsDate; -use Fisharebest\Webtrees\Html; use Fisharebest\Webtrees\I18N; use Fisharebest\Webtrees\View; @@ -83,7 +82,7 @@ class UserJournalModule extends AbstractModule implements ModuleBlockInterface { foreach ($articles as $article) { $content .= '<div class="journal_box">'; - $content .= '<div class="news_title">' . Html::escape($article->subject) . '</div>'; + $content .= '<div class="news_title">' . e($article->subject) . '</div>'; $content .= '<div class="news_date">' . FunctionsDate::formatTimestamp($article->updated) . '</div>'; if ($article->body == strip_tags($article->body)) { $article->body = nl2br($article->body, false); @@ -91,7 +90,7 @@ class UserJournalModule extends AbstractModule implements ModuleBlockInterface { $content .= $article->body; $content .= '<a href="editnews.php?news_id=' . $article->news_id . '&ctype=user&ged=' . $WT_TREE->getNameHtml() . '">' . I18N::translate('Edit') . '</a>'; $content .= ' | '; - $content .= '<a href="editnews.php?action=delete&news_id=' . $article->news_id . '&ctype=user&ged=' . $WT_TREE->getNameHtml() . '" onclick="return confirm(\'' . I18N::translate('Are you sure you want to delete “%s”?', Html::escape($article->subject)) . "');\">" . I18N::translate('Delete') . '</a><br>'; + $content .= '<a href="editnews.php?action=delete&news_id=' . $article->news_id . '&ctype=user&ged=' . $WT_TREE->getNameHtml() . '" onclick="return confirm(\'' . I18N::translate('Are you sure you want to delete “%s”?', e($article->subject)) . "');\">" . I18N::translate('Delete') . '</a><br>'; $content .= '</div><br>'; } diff --git a/app/Module/UserMessagesModule.php b/app/Module/UserMessagesModule.php index 0796498968..f76171f62f 100644 --- a/app/Module/UserMessagesModule.php +++ b/app/Module/UserMessagesModule.php @@ -88,13 +88,13 @@ class UserMessagesModule extends AbstractModule implements ModuleBlockInterface if (!empty($users)) { $url = route('user-page', ['ged' => $WT_TREE->getName()]); $content .= '<form action="message.php" onsubmit="return $("#to").val() !== """>'; - $content .= '<input type="hidden" name="ged" value="' . Html::escape($WT_TREE->getName()) . '">'; - $content .= '<input type="hidden" name="url" value="' . Html::escape($url) . '">'; + $content .= '<input type="hidden" name="ged" value="' . e($WT_TREE->getName()) . '">'; + $content .= '<input type="hidden" name="url" value="' . e($url) . '">'; $content .= '<label for="to">' . I18N::translate('Send a message') . '</label>'; $content .= '<select id="to" name="to">'; $content .= '<option value="">' . I18N::translate('<select>') . '</option>'; foreach ($users as $user) { - $content .= sprintf('<option value="%1$s">%2$s - %1$s</option>', Html::escape($user->getUserName()), Html::escape($user->getRealName())); + $content .= sprintf('<option value="%1$s">%2$s - %1$s</option>', e($user->getUserName()), e($user->getRealName())); } $content .= '</select>'; $content .= '<button type="submit">' . I18N::translate('Send') . '</button><br><br>'; @@ -113,7 +113,7 @@ class UserMessagesModule extends AbstractModule implements ModuleBlockInterface foreach ($messages as $message) { $content .= '<tr>'; $content .= '<td class="list_value_wrap center"><input type="checkbox" name="message_id[]" value="' . $message->message_id . '" id="cb_message' . $message->message_id . '"></td>'; - $content .= '<td class="list_value_wrap"><a href="#" onclick="return expand_layer(\'message' . $message->message_id . '\');"><i id="message' . $message->message_id . '_img" class="icon-plus"></i> <b dir="auto">' . Html::escape($message->subject) . '</b></a></td>'; + $content .= '<td class="list_value_wrap"><a href="#" onclick="return expand_layer(\'message' . $message->message_id . '\');"><i id="message' . $message->message_id . '_img" class="icon-plus"></i> <b dir="auto">' . e($message->subject) . '</b></a></td>'; $content .= '<td class="list_value_wrap">' . FunctionsDate::formatTimestamp($message->created + WT_TIMESTAMP_OFFSET) . '</td>'; $content .= '<td class="list_value_wrap">'; $user = User::findByIdentifier($message->sender); @@ -121,7 +121,7 @@ class UserMessagesModule extends AbstractModule implements ModuleBlockInterface $content .= $user->getRealNameHtml(); $content .= ' - <span dir="auto">' . $user->getEmail() . '</span>'; } else { - $content .= '<a href="mailto:' . Html::escape($message->sender) . '">' . Html::escape($message->sender) . '</a>'; + $content .= '<a href="mailto:' . e($message->sender) . '">' . e($message->sender) . '</a>'; } $content .= '</td>'; $content .= '</tr>'; diff --git a/app/Place.php b/app/Place.php index 5dedefe43f..0c6030baf8 100644 --- a/app/Place.php +++ b/app/Place.php @@ -142,7 +142,7 @@ class Place { public function getPlaceName() { $place = reset($this->gedcom_place); - return $place ? '<span dir="auto">' . Html::escape($place) . '</span>' : I18N::translate('unknown'); + return $place ? '<span dir="auto">' . e($place) . '</span>' : I18N::translate('unknown'); } /** @@ -162,12 +162,12 @@ class Place { public function getFullName() { if (true) { // If a place hierarchy is a single entity - return '<span dir="auto">' . Html::escape(implode(I18N::$list_separator, $this->gedcom_place)) . '</span>'; + return '<span dir="auto">' . e(implode(I18N::$list_separator, $this->gedcom_place)) . '</span>'; } else { // If a place hierarchy is a list of distinct items $tmp = []; foreach ($this->gedcom_place as $place) { - $tmp[] = '<span dir="auto">' . Html::escape($place) . '</span>'; + $tmp[] = '<span dir="auto">' . e($place) . '</span>'; } return implode(I18N::$list_separator, $tmp); @@ -195,7 +195,7 @@ class Place { $short_name = implode(self::GEDCOM_SEPARATOR, array_slice($this->gedcom_place, 0, $SHOW_PEDIGREE_PLACES)); } // Add a tool-tip showing the full name - return '<span title="' . Html::escape($this->getGedcomName()) . '" dir="auto">' . Html::escape($short_name) . '</span>'; + return '<span title="' . e($this->getGedcomName()) . '" dir="auto">' . e($short_name) . '</span>'; } } @@ -207,7 +207,7 @@ class Place { public function getReverseName() { $tmp = []; foreach (array_reverse($this->gedcom_place) as $place) { - $tmp[] = '<span dir="auto">' . Html::escape($place) . '</span>'; + $tmp[] = '<span dir="auto">' . e($place) . '</span>'; } return implode(I18N::$list_separator, $tmp); diff --git a/app/Stats.php b/app/Stats.php index 66e7a4b25b..9eac2e93c9 100644 --- a/app/Stats.php +++ b/app/Stats.php @@ -5891,9 +5891,9 @@ class Stats { if (Auth::check()) { foreach ($loggedusers as $user) { if ($type == 'list') { - $content .= '<li>' . Html::escape($user->getRealName()) . ' - ' . Html::escape($user->getUserName()); + $content .= '<li>' . e($user->getRealName()) . ' - ' . e($user->getUserName()); } else { - $content .= Html::escape($user->getRealName()) . ' - ' . Html::escape($user->getUserName()); + $content .= e($user->getRealName()) . ' - ' . e($user->getUserName()); } if (Auth::id() != $user->getUserId() && $user->getPreference('contactmethod') != 'none') { if ($type == 'list') { @@ -6002,10 +6002,10 @@ class Stats { */ public function userName($params = []) { if (Auth::check()) { - return Html::escape(Auth::user()->getUserName()); + return e(Auth::user()->getUserName()); } elseif (isset($params[0]) && $params[0] != '') { // if #username:visitor# was specified, then "visitor" will be returned when the user is not logged in - return Html::escape($params[0]); + return e($params[0]); } else { return ''; } @@ -6042,7 +6042,7 @@ class Stats { case 'userid': return $user->getUserId(); case 'username': - return Html::escape($user->getUserName()); + return e($user->getUserName()); case 'fullname': return $user->getRealNameHtml(); case 'regdate': diff --git a/app/Theme/AbstractTheme.php b/app/Theme/AbstractTheme.php index b95df679f9..dec42a2d00 100644 --- a/app/Theme/AbstractTheme.php +++ b/app/Theme/AbstractTheme.php @@ -332,9 +332,9 @@ abstract class AbstractTheme { case 'none': return ''; case 'mailto': - return '<a href="mailto:' . Html::escape($user->getEmail()) . '">' . $user->getRealNameHtml() . '</a>'; + return '<a href="mailto:' . e($user->getEmail()) . '">' . $user->getRealNameHtml() . '</a>'; default: - return '<a href="message.php?to=' . rawurlencode($user->getUserName()) . '&ged=' . $this->tree->getNameUrl() . '&url=' . Html::escape(Functions::getQueryUrl()) . '">' . $user->getRealNameHtml() . '</a>'; + return '<a href="message.php?to=' . rawurlencode($user->getUserName()) . '&ged=' . $this->tree->getNameUrl() . '&url=' . e(Functions::getQueryUrl()) . '">' . $user->getRealNameHtml() . '</a>'; } } @@ -1751,7 +1751,7 @@ abstract class AbstractTheme { 'url' => $this->request->getRequestUri() ]); - $url = Html::escape($url); + $url = e($url); $menu = new Menu(I18N::translate('Pending changes'), $url, 'menu-pending'); @@ -1876,7 +1876,7 @@ abstract class AbstractTheme { * @return string */ protected function metaCsrf() { - return '<meta name="csrf" content="' . Html::escape(Filter::getCsrfToken()) . '">'; + return '<meta name="csrf" content="' . e(Filter::getCsrfToken()) . '">'; } /** @@ -2176,6 +2176,6 @@ abstract class AbstractTheme { * @return string */ protected function title($title) { - return '<title>' . Html::escape($title) . '</title>'; + return '<title>' . e($title) . '</title>'; } } diff --git a/app/Tree.php b/app/Tree.php index 50ebec8b0c..2eead75278 100644 --- a/app/Tree.php +++ b/app/Tree.php @@ -115,7 +115,7 @@ class Tree { * @return string */ public function getNameHtml() { - return Html::escape($this->name); + return e($this->name); } /** @@ -142,7 +142,7 @@ class Tree { * @return string */ public function getTitleHtml() { - return '<span dir="auto">' . Html::escape($this->title) . '</span>'; + return '<span dir="auto">' . e($this->title) . '</span>'; } /** diff --git a/app/User.php b/app/User.php index f0363ab7e3..3f6c13ed86 100644 --- a/app/User.php +++ b/app/User.php @@ -411,7 +411,7 @@ class User { * @return string */ public function getRealNameHtml() { - return '<span dir="auto">' . Html::escape($this->real_name) . '</span>'; + return '<span dir="auto">' . e($this->real_name) . '</span>'; } /** diff --git a/block_edit.php b/block_edit.php index 21f5a60a0a..9533d25803 100644 --- a/block_edit.php +++ b/block_edit.php @@ -88,7 +88,7 @@ if (Module::getModuleByName('ckeditor')) { <?= FontAwesome::decorativeIcon('save') ?> <?= I18N::translate('save') ?> </button> - <a class="btn btn-secondary" href="<?= Html::escape($url) ?>"> + <a class="btn btn-secondary" href="<?= e($url) ?>"> <?= FontAwesome::decorativeIcon('cancel') ?> <?= I18N::translate('cancel') ?> </a> diff --git a/branches.php b/branches.php index 3a4ed51e3e..02bee3f75c 100644 --- a/branches.php +++ b/branches.php @@ -35,7 +35,7 @@ $controller->pageHeader(); <?= I18N::translate('Surname') ?> </label> <div class="col-sm-9 wt-page-options-value"> - <input class="form-control" data-autocomplete-type="SURN" type="text" name="surname" id="surname" value="<?= Html::escape($controller->getSurname()) ?>" dir="auto"> + <input class="form-control" data-autocomplete-type="SURN" type="text" name="surname" id="surname" value="<?= e($controller->getSurname()) ?>" dir="auto"> </div> </div> diff --git a/calendar.php b/calendar.php index 67f7e92d44..b628dc5508 100644 --- a/calendar.php +++ b/calendar.php @@ -553,7 +553,7 @@ $ajax_url = Html::url('calendar.php', [ $controller->pageHeader(); ?> - <div class="wt-ajax-load wt-page-content" data-ajax-url="<?= Html::escape($ajax_url) ?>"></div> + <div class="wt-ajax-load wt-page-content" data-ajax-url="<?= e($ajax_url) ?>"></div> <?php /** diff --git a/descendancy.php b/descendancy.php index 6fa4f9376c..310bbe1beb 100644 --- a/descendancy.php +++ b/descendancy.php @@ -106,4 +106,4 @@ $controller->pageHeader(); </div> </form> -<div class="wt-ajax-load wt-page-content wt-chart wt-descendants-chart" data-ajax-url="<?= Html::escape($ajax_url) ?>"></div> +<div class="wt-ajax-load wt-page-content wt-chart wt-descendants-chart" data-ajax-url="<?= e($ajax_url) ?>"></div> diff --git a/edit_changes.php b/edit_changes.php index 8437c8721a..817ddabd1f 100644 --- a/edit_changes.php +++ b/edit_changes.php @@ -174,7 +174,7 @@ foreach ($rows as $row) { <?= I18N::translate('There are no pending changes.') ?> </p> <p> - <a class="btn btn-primary" href="<?= Html::escape($url) ?>"> + <a class="btn btn-primary" href="<?= e($url) ?>"> <?= I18N::translate('continue') ?> </a> </p> @@ -200,7 +200,7 @@ foreach ($rows as $row) { <thead class="thead-default"> <tr> <th colspan="5"> - <a href="<?= Html::escape($record_changes[0]->record->url()) ?>"><?= $record_changes[0]->record->getFullName() ?></a> + <a href="<?= e($record_changes[0]->record->url()) ?>"><?= $record_changes[0]->record->getFullName() ?></a> </th> </tr> <tr> @@ -227,8 +227,8 @@ foreach ($rows as $row) { <?php endforeach ?> </td> <td> - <a href="<?= Html::escape($record_change->message_url) ?>" title="<?= I18N::translate('Send a message') ?>"> - <?= Html::escape($record_change->real_name)?> - <?= Html::escape($record_change->user_name) ?> + <a href="<?= e($record_change->message_url) ?>" title="<?= I18N::translate('Send a message') ?>"> + <?= e($record_change->real_name)?> - <?= e($record_change->user_name) ?> </a> </td> <td> diff --git a/edit_interface.php b/edit_interface.php index acf736d545..747ca4d701 100644 --- a/edit_interface.php +++ b/edit_interface.php @@ -71,7 +71,7 @@ case 'editraw': </div> <input type="hidden" name="fact_id[]" value="<?= $fact->getFactId() ?>"> <textarea name="fact[]" dir="ltr" rows="<?= preg_match_all('/\n/', $fact->getGedcom()) ?>" - style="width:100%;"><?= Html::escape($fact->getGedcom()) ?></textarea> + style="width:100%;"><?= e($fact->getGedcom()) ?></textarea> </li> <?php endif ?> <?php endforeach ?> @@ -189,7 +189,7 @@ case 'editrawfact': </label> <div class="col-sm-9"> <textarea autofocus class="form-control" rows="<?= $rows ?>" name="gedcom" id="gedcom" - dir="ltr"><?= Html::escape($edit_fact->getGedcom()) ?></textarea> + dir="ltr"><?= e($edit_fact->getGedcom()) ?></textarea> </div> </div> <?= keep_chan($record) ?> @@ -1257,7 +1257,7 @@ case 'editnote': <tr> <th scope="row"><?= I18N::translate('Shared note') ?></th> <td> - <textarea name="NOTE" id="NOTE" rows="15" cols="90"><?= Html::escape($note->getNote()) ?></textarea> + <textarea name="NOTE" id="NOTE" rows="15" cols="90"><?= e($note->getNote()) ?></textarea> <br> <?= FunctionsPrint::printSpecialCharacterLink('NOTE') ?> </td> @@ -2123,7 +2123,7 @@ function keep_chan(GedcomRecord $record = null) { if ($record) { $details = GedcomTag::getLabelValue('DATE', $record->lastChangeTimestamp()) . - GedcomTag::getLabelValue('_WT_USER', Html::escape($record->lastChangeUser())); + GedcomTag::getLabelValue('_WT_USER', e($record->lastChangeUser())); } else { $details = ''; } @@ -2440,7 +2440,7 @@ function print_indi_form($nextaction, Individual $person = null, Family $family <?= /* I18N: A button label. */ I18N::translate('go to new individual') ?> </button> <?php endif ?> - <a class="btn btn-secondary" href="<?= Html::escape($person ? $person->url() : $family->url()) ?>"> + <a class="btn btn-secondary" href="<?= e($person ? $person->url() : $family->url()) ?>"> <?= FontAwesome::decorativeIcon('cancel') ?> <?= /* I18N: A button label. */ I18N::translate('cancel') ?> </a> diff --git a/editnews.php b/editnews.php index b496b0e910..89526a41dd 100644 --- a/editnews.php +++ b/editnews.php @@ -102,7 +102,7 @@ if (Module::getModuleByName('ckeditor')) { <tr> <tr> <td> - <input type="text" id="subject" name="subject" size="50" dir="auto" autofocus value="<?= Html::escape($news['subject']) ?>"> + <input type="text" id="subject" name="subject" size="50" dir="auto" autofocus value="<?= e($news['subject']) ?>"> </td> </tr> <tr> @@ -114,7 +114,7 @@ if (Module::getModuleByName('ckeditor')) { </tr> <tr> <td> - <textarea id="body" name="body" class="html-edit" cols="80" rows="10" dir="auto"><?= Html::escape($news['body']) ?></textarea> + <textarea id="body" name="body" class="html-edit" cols="80" rows="10" dir="auto"><?= e($news['body']) ?></textarea> </td> </tr> <tr> diff --git a/edituser.php b/edituser.php index 9e8e062ddc..3757d30d9f 100644 --- a/edituser.php +++ b/edituser.php @@ -132,7 +132,7 @@ function checkform(frm) { <?= I18N::translate('Username') ?> </label> <div class="col-sm-9"> - <input type="text" class="form-control" id="username" name="username" value="<?= Html::escape(Auth::user()->getUserName()) ?>" dir="auto" aria-describedby="username-description" required> + <input type="text" class="form-control" id="username" name="username" value="<?= e(Auth::user()->getUserName()) ?>" dir="auto" aria-describedby="username-description" required> <p class="small text-muted" id="username-description"> <?= I18N::translate('Usernames are case-insensitive and ignore accented letters, so that “chloe”, “chloë”, and “Chloe” are considered to be the same.') ?> </p> @@ -144,7 +144,7 @@ function checkform(frm) { <?= I18N::translate('Real name') ?> </label> <div class="col-sm-9"> - <input type="text" class="form-control" id="real-name" name="real-name" value="<?= Html::escape(Auth::user()->getRealName()) ?>" dir="auto" aria-describedby="real-name-description" required> + <input type="text" class="form-control" id="real-name" name="real-name" value="<?= e(Auth::user()->getRealName()) ?>" dir="auto" aria-describedby="real-name-description" required> <p class="small text-muted" id="username-description"> <?= I18N::translate('This is your real name, as you would like it displayed on screen.') ?> </p> @@ -233,7 +233,7 @@ function checkform(frm) { <?= I18N::translate('Email address') ?> </label> <div class="col-sm-9"> - <input class="form-control" type="email" id="email" name="email" value="<?= Html::escape(Auth::user()->getEmail()) ?>" aria-describedby="email-description"> + <input class="form-control" type="email" id="email" name="email" value="<?= e(Auth::user()->getEmail()) ?>" aria-describedby="email-description"> <p class="small text-muted" id="email-description"> <?= I18N::translate('This email address will be used to send password reminders, website notifications, and messages from other family members who are registered on the website.') ?> </p> @@ -248,7 +248,7 @@ function checkform(frm) { <div class="col-sm-9"> <select class="form-control" id="theme" name="theme" aria-describedby="theme-description"> <option value=""> - <?= Html::escape(/* I18N: default option in list of themes */ I18N::translate('<default theme>')) ?> + <?= e(/* I18N: default option in list of themes */ I18N::translate('<default theme>')) ?> </option> <?php foreach (Theme::themeNames() as $theme_id => $theme_name): ?> <option value="<?= $theme_id ?>" <?= $theme_id === Auth::user()->getPreference('theme') ? 'selected' : '' ?>> @@ -302,7 +302,7 @@ function checkform(frm) { <?= Filter::getCsrf() ?> <div class="row form-group"> <div class="col-sm-9 offset-sm-3"> - <input class="btn btn-danger" type="submit" value="<?= I18N::translate('Delete your account') ?>" data-confirm="<?= I18N::translate('Are you sure you want to delete “%s”?', Html::escape(Auth::user()->getUserName())) ?>" onclick="return confirm(this.dataset.confirm);"> + <input class="btn btn-danger" type="submit" value="<?= I18N::translate('Delete your account') ?>" data-confirm="<?= I18N::translate('Are you sure you want to delete “%s”?', e(Auth::user()->getUserName())) ?>" onclick="return confirm(this.dataset.confirm);"> </div> </div> </form> diff --git a/famlist.php b/famlist.php index 12abb2e310..b5ce3cf348 100644 --- a/famlist.php +++ b/famlist.php @@ -57,7 +57,7 @@ if ($show_all === 'yes') { } elseif ($falpha) { $alpha = ''; $surname = ''; - $legend = I18N::translate('All') . ', ' . Html::escape($falpha) . '…'; + $legend = I18N::translate('All') . ', ' . e($falpha) . '…'; $url = '?show_all=yes&ged=' . $controller->tree()->getNameUrl(); $show = 'indi'; } else { @@ -86,7 +86,7 @@ if ($show_all === 'yes') { $url .= '&falpha=' . rawurlencode($falpha) . '&ged=' . $controller->tree()->getNameUrl(); break; default: - $legend .= ', ' . Html::escape($falpha) . '…'; + $legend .= ', ' . e($falpha) . '…'; $url .= '&falpha=' . rawurlencode($falpha) . '&ged=' . $controller->tree()->getNameUrl(); break; } @@ -103,7 +103,7 @@ if ($show_all === 'yes') { $show = 'indi'; // SURN list makes no sense here } elseif ($alpha) { $show_all = 'no'; - $legend = Html::escape($alpha) . '…'; + $legend = e($alpha) . '…'; $url = '?alpha=' . rawurlencode($alpha) . '&ged=' . $controller->tree()->getNameUrl(); $show = Filter::get('show', 'surn|indi', 'surn'); } else { diff --git a/indilist.php b/indilist.php index e8e56bd032..c5ea370f29 100644 --- a/indilist.php +++ b/indilist.php @@ -57,7 +57,7 @@ if ($show_all === 'yes') { } elseif ($falpha) { $alpha = ''; $surname = ''; - $legend = I18N::translate('All') . ', ' . Html::escape($falpha) . '…'; + $legend = I18N::translate('All') . ', ' . e($falpha) . '…'; $url = '?show_all=yes&ged=' . $controller->tree()->getNameUrl(); $show = 'indi'; } else { @@ -86,7 +86,7 @@ if ($show_all === 'yes') { $url .= '&falpha=' . rawurlencode($falpha) . '&ged=' . $controller->tree()->getNameUrl(); break; default: - $legend .= ', ' . Html::escape($falpha) . '…'; + $legend .= ', ' . e($falpha) . '…'; $url .= '&falpha=' . rawurlencode($falpha) . '&ged=' . $controller->tree()->getNameUrl(); break; } @@ -103,7 +103,7 @@ if ($show_all === 'yes') { $show = 'indi'; // SURN list makes no sense here } elseif ($alpha) { $show_all = 'no'; - $legend = Html::escape($alpha) . '…'; + $legend = e($alpha) . '…'; $url = '?alpha=' . rawurlencode($alpha) . '&ged=' . $controller->tree()->getNameUrl(); $show = Filter::get('show', 'surn|indi', 'surn'); } else { diff --git a/individual.php b/individual.php index 59c0fdc4e2..51aca95d99 100644 --- a/individual.php +++ b/individual.php @@ -84,7 +84,7 @@ $user_link = ''; if (Auth::isAdmin()) { $user = User::findByIndividual($controller->record); if ($user) { - $user_link = ' — <a href="admin_users.php?filter=' . Html::escape($user->getUserName()) . '">' . Html::escape($user->getUserName()) . '</a>'; + $user_link = ' — <a href="admin_users.php?filter=' . e($user->getUserName()) . '">' . e($user->getUserName()) . '</a>'; }; } @@ -166,13 +166,13 @@ $individual_media = array_filter($individual_media); <?php if (Auth::isEditor($WT_TREE)): ?> <?php if (count($controller->record->getFacts('OBJE')) > 1): ?> - <div><a href="<?= Html::escape(Html::url('edit_interface.php', ['action' => 'reorder-media', 'ged' => $controller->record->getTree()->getName(), 'xref' => $controller->record->getXref()])) ?>"> + <div><a href="<?= e(Html::url('edit_interface.php', ['action' => 'reorder-media', 'ged' => $controller->record->getTree()->getName(), 'xref' => $controller->record->getXref()])) ?>"> <?= I18N::translate('Re-order media') ?> </a></div> <?php endif ?> <?php if ($WT_TREE->getPreference('MEDIA_UPLOAD') >= Auth::accessLevel($WT_TREE)): ?> - <div><a href="<?= Html::escape(Html::url('edit_interface.php', ['action' => 'add-media-link', 'ged' => $controller->record->getTree()->getName(), 'xref' => $controller->record->getXref()])) ?>"> + <div><a href="<?= e(Html::url('edit_interface.php', ['action' => 'add-media-link', 'ged' => $controller->record->getTree()->getName(), 'xref' => $controller->record->getXref()])) ?>"> <?= I18N::translate('Add a media object') ?> </a></div> <?php endif ?> @@ -192,17 +192,17 @@ $individual_media = array_filter($individual_media); <div class="card"> <div class="card-header" role="tab" id="name-header-add"> <div class="card-title mb-0"> - <a href="<?= Html::escape(Html::url('edit_interface.php', ['action' => 'addname', 'ged' => $controller->tree()->getName(), 'xref' => $controller->record->getXref()])) ?>"> + <a href="<?= e(Html::url('edit_interface.php', ['action' => 'addname', 'ged' => $controller->tree()->getName(), 'xref' => $controller->record->getXref()])) ?>"> <?= I18N::translate('Add a name') ?> </a> <?php if (count($controller->record->getFacts('NAME')) > 1): ?> - <a href="<?= Html::escape(Html::url('edit_interface.php', ['action' => 'reorder-names', 'ged' => $controller->tree()->getName(), 'xref' => $controller->record->getXref()])) ?>"> + <a href="<?= e(Html::url('edit_interface.php', ['action' => 'reorder-names', 'ged' => $controller->tree()->getName(), 'xref' => $controller->record->getXref()])) ?>"> <?= I18N::translate('Re-order names') ?> </a> <?php endif ?> <?php if (count($controller->record->getFacts('SEX')) === 0): ?> - <a href="<?= Html::escape(Html::url('edit_interface.php', ['action' => 'add', 'fact' => 'SEX', 'ged' => $controller->tree()->getName(), 'xref' => $controller->record->getXref()])) ?>"> + <a href="<?= e(Html::url('edit_interface.php', ['action' => 'add', 'fact' => 'SEX', 'ged' => $controller->tree()->getName(), 'xref' => $controller->record->getXref()])) ?>"> <?= I18N::translate('Edit the gender') ?> </a> <?php endif ?> diff --git a/inverselink.php b/inverselink.php index 3f2132b07a..311b474f32 100644 --- a/inverselink.php +++ b/inverselink.php @@ -68,7 +68,7 @@ if ($linkto == 'manage' && Module::getModuleByName('GEDFact_assistant')) { ->execute([$mediaid, $WT_TREE->getTreeId()]) ->fetchOne(); if ($title) { - echo '<b>', Html::escape($title), '</b>'; + echo '<b>', e($title), '</b>'; } else { echo '<b>', $mediaid, '</b>'; } diff --git a/lifespan.php b/lifespan.php index c9b8870e6e..0f456c40c6 100644 --- a/lifespan.php +++ b/lifespan.php @@ -119,4 +119,4 @@ $controller->pageHeader(); </div> </form> -<div class="wt-ajax-load wt-page-content wt-chart wt-lifespans-chart" data-ajax-url="<?= Html::escape($ajax_url) ?>"></div> +<div class="wt-ajax-load wt-page-content wt-chart wt-lifespans-chart" data-ajax-url="<?= e($ajax_url) ?>"></div> @@ -186,10 +186,10 @@ switch ($action) { } echo '<form id="login-form" name="login-form" method="post" action="', WT_LOGIN_URL, '"> <input type="hidden" name="action" value="login"> - <input type="hidden" name="url" value="', Html::escape($url), '">'; + <input type="hidden" name="url" value="', e($url), '">'; echo '<div> <label for="username">', I18N::translate('Username'), - '<input type="text" id="username" name="username" value="', Html::escape($username), '" class="formField" autofocus> + '<input type="text" id="username" name="username" value="', e($username), '" class="formField" autofocus> </label> </div> <div> @@ -266,9 +266,9 @@ switch ($action) { View::make('emails/password-reset-html', ['user' => $user, 'new_password' => $user_new_pw]) ); - FlashMessages::addMessage(I18N::translate('A new password has been created and emailed to %s. You can change this password after you sign in.', Html::escape($username)), 'success'); + FlashMessages::addMessage(I18N::translate('A new password has been created and emailed to %s. You can change this password after you sign in.', e($username)), 'success'); } else { - FlashMessages::addMessage(I18N::translate('There is no account with the username or email “%s”.', Html::escape($username)), 'danger'); + FlashMessages::addMessage(I18N::translate('There is no account with the username or email “%s”.', e($username)), 'danger'); } header('Location: login.php'); @@ -397,7 +397,7 @@ switch ($action) { <div> <label for="user_realname"> <?= I18N::translate('Real name') ?> - <input type="text" id="user_realname" name="user_realname" required maxlength="64" value="<?= Html::escape($user_realname) ?>" autofocus> + <input type="text" id="user_realname" name="user_realname" required maxlength="64" value="<?= e($user_realname) ?>" autofocus> </label> <p class="small text-muted"> <?= I18N::translate('This is your real name, as you would like it displayed on screen.') ?> @@ -407,7 +407,7 @@ switch ($action) { <div> <label for="user_email"> <?= I18N::translate('Email address') ?> - <input type="email" id="user_email" name="user_email" required maxlength="64" value="<?= Html::escape($user_email) ?>"> + <input type="email" id="user_email" name="user_email" required maxlength="64" value="<?= e($user_email) ?>"> </label> <p class="small text-muted"> <?= I18N::translate('This email address will be used to send password reminders, website notifications, and messages from other family members who are registered on the website.') ?> @@ -417,7 +417,7 @@ switch ($action) { <div> <label for="username"> <?= I18N::translate('Username') ?> - <input type="text" id="username" name="username" required maxlength="32" value="<?php Html::escape($username) ?>" autocomplete="username"> + <input type="text" id="username" name="username" required maxlength="32" value="<?php e($username) ?>" autocomplete="username"> </label> <p class="small text-muted"> <?= I18N::translate('Usernames are case-insensitive and ignore accented letters, so that “chloe”, “chloë”, and “Chloe” are considered to be the same.') ?> @@ -430,7 +430,7 @@ switch ($action) { <input required type="password" id="user_password01" name="user_password01" - value="<?= Html::escape($user_password01) ?>" + value="<?= e($user_password01) ?>" placeholder="<?= /* I18N: placeholder text for new-password field */ I18N::plural('Use at least %s character.', 'Use at least %s characters.', WT_MINIMUM_PASSWORD_LENGTH, I18N::number(WT_MINIMUM_PASSWORD_LENGTH)) ?>" pattern="<?= WT_REGEX_PASSWORD ?>" onchange="form.user_password02.pattern = regex_quote(this.value);" @@ -447,7 +447,7 @@ switch ($action) { <input required type="password" id="user_password02" name="user_password02" - value="<?= Html::escape($user_password02) ?>" + value="<?= e($user_password02) ?>" placeholder="<?= /* I18N: placeholder text for repeat-password field */ I18N::translate('Type the password again.') ?>" pattern="<?= WT_REGEX_PASSWORD ?>" > @@ -464,7 +464,7 @@ switch ($action) { cols="50" rows="5" id="user_comments" name="user_comments" placeholder="<?php /* I18N: placeholder text for registration-comments field */ I18N::translate('Explain why you are requesting an account.') ?>" - ><?= Html::escape($user_comments) ?></textarea> + ><?= e($user_comments) ?></textarea> </label> <p class="small text-muted"> <?= I18N::translate('Use this field to tell the site administrator why you are requesting an account and how you are related to the genealogy displayed on this site. You can also use this to enter any other comments you may have for the site administrator.') ?> diff --git a/medialist.php b/medialist.php index 4421bb12ca..c27e13dc33 100644 --- a/medialist.php +++ b/medialist.php @@ -109,7 +109,7 @@ $medialist = QueryMedia::mediaList( <?= I18N::translate('Search filters') ?> </label> <div class="col-sm-3 wt-page-options-value"> - <input type="text" class="form-control" name="filter" id="filter" value="<?= Html::escape($filter) ?>"> + <input type="text" class="form-control" name="filter" id="filter" value="<?= e($filter) ?>"> </div> <div class="col-sm-3 col-form-label wt-page-options-label"> diff --git a/message.php b/message.php index c7e6e9c40c..19d7475e83 100644 --- a/message.php +++ b/message.php @@ -72,7 +72,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') { // No errors. Send the message. foreach ($recipients as $recipient) { if (deliverMessage($WT_TREE, $from_email, $from_name, $recipient, $subject, $body, $url)) { - FlashMessages::addMessage(I18N::translate('The message was successfully sent to %s.', Html::escape($to)), 'info'); + FlashMessages::addMessage(I18N::translate('The message was successfully sent to %s.', e($to)), 'info'); } else { FlashMessages::addMessage(I18N::translate('The message was not sent.'), 'danger'); Log::addErrorLog('Unable to send a message. FROM:' . $from_email . ' TO:' . $recipient->getEmail()); @@ -105,15 +105,15 @@ $to_names = implode(I18N::$list_separator, array_map(function (User $user) { <form method="post"> <?= Filter::getCsrf() ?> - <input type="hidden" name="url" value="<?= Html::escape($url) ?>"> + <input type="hidden" name="url" value="<?= e($url) ?>"> <div class="form-group row"> <div class="col-sm-3 col-form-label"> <?= I18N::translate('To') ?> </div> <div class="col-sm-9"> - <input type="hidden" name="to" value="<?= Html::escape($to) ?>"> - <div class="form-control"><?= Html::escape($to_names) ?></div> + <input type="hidden" name="to" value="<?= e($to) ?>"> + <div class="form-control"><?= e($to_names) ?></div> </div> </div> @@ -123,7 +123,7 @@ $to_names = implode(I18N::$list_separator, array_map(function (User $user) { <?= I18N::translate('From') ?> </div> <div class="col-sm-9"> - <div class="form-control"><?= Html::escape(Auth::user()->getRealName()) ?></div> + <div class="form-control"><?= e(Auth::user()->getRealName()) ?></div> </div> </div> <?php else: ?> @@ -132,7 +132,7 @@ $to_names = implode(I18N::$list_separator, array_map(function (User $user) { <?= I18N::translate('Your name') ?> </label> <div class="col-sm-9"> - <input class="form-control" id="from-name" type="text" name="from_name" value="<?= Html::escape($from_name) ?>" required> + <input class="form-control" id="from-name" type="text" name="from_name" value="<?= e($from_name) ?>" required> </div> </div> <div class="form-group row"> @@ -140,7 +140,7 @@ $to_names = implode(I18N::$list_separator, array_map(function (User $user) { <?= I18N::translate('Email address') ?> </label> <div class="col-sm-9"> - <input class="form-control" id="from-email" type="text" name="from_email" value="<?= Html::escape($from_email) ?>" required> + <input class="form-control" id="from-email" type="text" name="from_email" value="<?= e($from_email) ?>" required> </div> </div> <?php endif ?> @@ -150,7 +150,7 @@ $to_names = implode(I18N::$list_separator, array_map(function (User $user) { <?= I18N::translate('Subject') ?> </label> <div class="col-sm-9"> - <input class="form-control" id="subject" type="text" name="subject" value="<?= Html::escape($subject) ?>" required> + <input class="form-control" id="subject" type="text" name="subject" value="<?= e($subject) ?>" required> </div> </div> @@ -159,7 +159,7 @@ $to_names = implode(I18N::$list_separator, array_map(function (User $user) { <?= I18N::translate('Body') ?> </label> <div class="col-sm-9"> - <textarea class="form-control" id="body" type="text" name="body" required><?= Html::escape($body) ?></textarea> + <textarea class="form-control" id="body" type="text" name="body" required><?= e($body) ?></textarea> </div> </div> @@ -168,7 +168,7 @@ $to_names = implode(I18N::$list_separator, array_map(function (User $user) { <button type="submit" class="btn btn-primary"> <?= I18N::translate('Send') ?> </button> - <a class="btn btn-link" href="<?= Html::escape($url) ?>"> + <a class="btn btn-link" href="<?= e($url) ?>"> <?= I18N::translate('cancel') ?> </a> </div> diff --git a/modules_v3/GEDFact_assistant/MEDIA_ctrl.php b/modules_v3/GEDFact_assistant/MEDIA_ctrl.php index 0ad106d45d..0b3f35ae4f 100644 --- a/modules_v3/GEDFact_assistant/MEDIA_ctrl.php +++ b/modules_v3/GEDFact_assistant/MEDIA_ctrl.php @@ -132,7 +132,7 @@ function print_navigator_family(Family $family, Individual $individual) { ?> <tr> <td> - <a href="#" onclick="opener.insertRowToTable('<?= $spouse->getXref() ?>', '<?= Html::escape($spouse->getFullName()) ?>', '', '', '', '', '', '', '', ''); return false;"> + <a href="#" onclick="opener.insertRowToTable('<?= $spouse->getXref() ?>', '<?= e($spouse->getFullName()) ?>', '', '', '', '', '', '', '', ''); return false;"> <?= $spouse === $individual ? '<b>' : '' ?> <?= $spouse->getFullName() ?> <?= $spouse->getLifeSpan() ?> <?= $spouse === $individual ? '</b>' : '' ?> @@ -153,7 +153,7 @@ function print_navigator_family(Family $family, Individual $individual) { ?> <tr> <td> - <a href="#" onclick="opener.insertRowToTable('<?= $child->getXref() ?>', '<?= Html::escape($child->getFullName()) ?>', '', '', '', '', '', '', '', ''); return false;"> + <a href="#" onclick="opener.insertRowToTable('<?= $child->getXref() ?>', '<?= e($child->getFullName()) ?>', '', '', '', '', '', '', '', ''); return false;"> <?= $child === $individual ? '<b>' : '' ?> <?= $child->getFullName() ?> <?= $child->getLifeSpan() ?> <?= $child === $individual ? '</b>' : '' ?> diff --git a/placelist.php b/placelist.php index 69fbbddc90..71516883ed 100644 --- a/placelist.php +++ b/placelist.php @@ -33,7 +33,7 @@ $level = count($parent); if ($display == 'hierarchy') { if ($level) { - $controller->setPageTitle(I18N::translate('Place hierarchy') . ' - <span dir="auto">' . Html::escape($parent[$level - 1]) . '</span>'); + $controller->setPageTitle(I18N::translate('Place hierarchy') . ' - <span dir="auto">' . e($parent[$level - 1]) . '</span>'); } else { $controller->setPageTitle(I18N::translate('Place hierarchy')); } diff --git a/search.php b/search.php index 70ae77aed8..2a6e7509f3 100644 --- a/search.php +++ b/search.php @@ -71,7 +71,7 @@ function checknames(frm) { </label> <div class="col-sm-9 wt-page-options-value"> <div class="input-group input-group-sm"> - <input id="query" class="form-control form-control-sm" type="text" name="query" value="<?= Html::escape($controller->query) ?>" autofocus> + <input id="query" class="form-control form-control-sm" type="text" name="query" value="<?= e($controller->query) ?>" autofocus> <div class="input-group-append"> <span class="input-group-text"> <?= FunctionsPrint::printSpecialCharacterLink('query') ?> @@ -178,7 +178,7 @@ function checknames(frm) { <?= I18N::translate('Search for') ?> </label> <div class="col-sm-9 wt-page-options-value"> - <input class="form-control form-control-sm" name="query" value="<?= Html::escape($controller->query) ?>" type="text" autofocus> + <input class="form-control form-control-sm" name="query" value="<?= e($controller->query) ?>" type="text" autofocus> </div> </div> <div class="row form-group"> @@ -186,7 +186,7 @@ function checknames(frm) { <?= I18N::translate('Replace with') ?> </label> <div class="col-sm-9 wt-page-options-value"> - <input class="form-control form-control-sm" name="replace" value="<?= Html::escape($controller->replace) ?>" type="text"> + <input class="form-control form-control-sm" name="replace" value="<?= e($controller->replace) ?>" type="text"> </div> </div> <script> @@ -256,7 +256,7 @@ function checknames(frm) { </label> <div class="col-sm-9 wt-page-options-value"> <div class="input-group input-group-sm"> - <input class= "form-control form-control-sm" type="text" name="firstname" id="firstname" value="<?= Html::escape($controller->firstname) ?>" autofocus> + <input class= "form-control form-control-sm" type="text" name="firstname" id="firstname" value="<?= e($controller->firstname) ?>" autofocus> <div class="input-group-append"> <span class="input-group-text"> <?= FunctionsPrint::printSpecialCharacterLink('query') ?> @@ -271,7 +271,7 @@ function checknames(frm) { </label> <div class="col-sm-9 wt-page-options-value"> <div class="input-group input-group-sm"> - <input class="form-control form-control-sm" type="text" name="lastname" id="lastname" value="<?= Html::escape($controller->lastname) ?>"> + <input class="form-control form-control-sm" type="text" name="lastname" id="lastname" value="<?= e($controller->lastname) ?>"> <div class="input-group-append"> <span class="input-group-text"> <?= FunctionsPrint::printSpecialCharacterLink('query') ?> @@ -285,7 +285,7 @@ function checknames(frm) { <?= I18N::translate('Place') ?> </label> <div class="col-sm-9 wt-page-options-value"> - <input class="form-control form-control-sm" type="text" name="place" id="place" value="<?= Html::escape($controller->place) ?>"> + <input class="form-control form-control-sm" type="text" name="place" id="place" value="<?= e($controller->place) ?>"> </div> </div> <div class="row form-group"> @@ -293,7 +293,7 @@ function checknames(frm) { <?= I18N::translate('Year') ?> </label> <div class="col-sm-9 wt-page-options-value"> - <input class="form-control form-control-sm" type="text" name="year" id="year" value="<?= Html::escape($controller->year) ?>"> + <input class="form-control form-control-sm" type="text" name="year" id="year" value="<?= e($controller->year) ?>"> </div> </div> <fieldset class="form-group"> diff --git a/search_advanced.php b/search_advanced.php index a341a6fd2a..2241febb7b 100644 --- a/search_advanced.php +++ b/search_advanced.php @@ -143,7 +143,7 @@ $controller->pageHeader(); ?> <div class="col-sm-9 wt-page-options-value form-row mx-0"> <input class="form-control form-control-sm col-9" type="text" id="value<?= $i ?>" name="values[<?= $i ?>]" - value="<?= Html::escape($controller->getValue($i)) ?>"> + value="<?= e($controller->getValue($i)) ?>"> <?php if (preg_match('/^NAME:/', $currentFieldSearch) > 0): ?> <select class="form-control form-control-sm col-3" name="fields[<?= $i ?>]"> <option value="<?= $currentField ?>:EXACT" <?php if (preg_match('/:EXACT$/', $currentFieldSearch) > 0) echo 'selected' ?>> diff --git a/statisticsplot.php b/statisticsplot.php index fd875dee4b..9cc11d9ccd 100644 --- a/statisticsplot.php +++ b/statisticsplot.php @@ -684,7 +684,7 @@ function my_plot($chart_title, $xdata, $xtitle, $ydata, $ytitle, $legend) { $imgurl .= rawurlencode($data); } } - echo '<img src="', $imgurl, '" width="950" height="300" alt="', Html::escape($chart_title), '">'; + echo '<img src="', $imgurl, '" width="950" height="300" alt="', e($chart_title), '">'; } /** diff --git a/timeline.php b/timeline.php index 2417cd8770..50290be70a 100644 --- a/timeline.php +++ b/timeline.php @@ -397,7 +397,7 @@ $controller->pageHeader(); <a href="<?= e($indi->url()) ?>"> <?= $indi->getFullName() ?><br> <?= $indi->getAddName() ?><br> </a> - <input type="hidden" name="pids[<?= $p ?>]" value="<?= Html::escape($pid) ?>"> + <input type="hidden" name="pids[<?= $p ?>]" value="<?= e($pid) ?>"> <a href="timeline.php?<?= $controller->pidlinks ?>&scale=<?= $controller->scale ?>&remove=<?= $pid ?>&ged=<?= $controller->tree()->getNameUrl() ?>"> <span class="details1"><?= I18N::translate('Remove individual') ?></span></a> <?php if (!empty($controller->birthyears[$pid])) { ?> @@ -412,7 +412,7 @@ $controller->pageHeader(); } else { echo '<div class="error">', I18N::translate('This information is private and cannot be shown.'), '</div>'; ?> - <input type="hidden" name="pids[<?= $p ?>]" value="<?= Html::escape($pid) ?>"> + <input type="hidden" name="pids[<?= $p ?>]" value="<?= e($pid) ?>"> <br> <a href="timeline.php?<?= $controller->pidlinks ?>&scale=<?= $controller->scale ?>&remove=<?= $pid ?>&ged=<?= $controller->tree()->getNameUrl() ?>"> <span class="details1"><?= I18N::translate('Remove individual') ?></span></a> |