tonyair/silverstripe-cms
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-cms synced 2024-09-29 20:59:05 +02:00
Code Issues Projects Releases Wiki Activity

Clearer escaping in CMSMain

Browse Source 
No direct security issue, but makes intent clearer
This commit is contained in:
Ingo Schommer 2013-09-24 12:12:57 +02:00
parent ec9c15917d
commit f477983bff
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
code/controllers/CMSMain.php
View File

@ -783,13 +783,21 @@ class CMSMain extends LeftAndMain implements CurrentPageIdentifier, PermissionPr
if($num) {
return sprintf(
'<a class="cms-panel-link list-children-link" data-pjax-target="ListViewForm,Breadcrumbs" href="%s">%s</a>',
Controller::join_links($controller->Link(), "?ParentID={$item->ID}&view=list"),
Controller::join_links(
$controller->Link(),
sprintf("?ParentID=%d&view=list", (int)$item->ID)
),
$num
);
}
},
'getTreeTitle' => function($value, &$item) use($controller) {
return '<a class="action-detail" href="' . singleton('CMSPageEditController')->Link('show') . '/' . $item->ID . '">' . $item->TreeTitle . '</a>';
return sprintf(
'<a class="action-detail" href="%s/%d">%s</a>',
singleton('CMSPageEditController')->Link('show'),
(int)$item->ID,
$item->TreeTitle // returns HTML, does its own escaping
);
}
));