tonyair/silverstripe-framework
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-framework synced 2024-10-22 14:05:37 +02:00
Code Issues Projects Releases Wiki Activity

BUGFIX Fixed XSS in admin/security and "My Profile" forms

Browse Source
This commit is contained in:
Ingo Schommer 2013-01-04 16:47:50 +01:00
parent 7830b5d1b1
commit 7bb0bbff0e
1 changed files with 18 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
forms/MemberDatetimeOptionsetField.php
View File

@ -35,17 +35,27 @@ class MemberDatetimeOptionsetField extends OptionsetField {
$value = ($this->value && !array_key_exists($this->value, $this->source)) ? $this->value : null; $value = ($this->value && !array_key_exists($this->value, $this->source)) ? $this->value : null;
$checked = ($value) ? " checked=\"checked\"" : ''; $checked = ($value) ? " checked=\"checked\"" : '';
$options .= "<li class=\"valCustom\">" $options .= "<li class=\"valCustom\">"
. sprintf("<input id=\"%s_custom\" name=\"%s\" type=\"radio\" value=\"__custom__\" class=\"radio\" %s />", . sprintf(
$itemID, $this->name, $checked) "<input id=\"%s_custom\" name=\"%s\" type=\"radio\" value=\"__custom__\" class=\"radio\" %s />",
. sprintf('<label for="%s_custom">%s:</label>', $itemID, $this->name,
$itemID, _t('MemberDatetimeOptionsetField.Custom', 'Custom')) $checked
. sprintf("<input class=\"customFormat\" name=\"%s_custom\" value=\"%s\" />\n", $this->name, $value) )
. sprintf("<input type=\"hidden\" class=\"formatValidationURL\" value=\"%s\" />", . sprintf(
$this->Link() . '/validate'); '<label for="%s_custom">%s:</label>',
$itemID, _t('MemberDatetimeOptionsetField.Custom', 'Custom')
)
. sprintf(
"<input class=\"customFormat\" name=\"%s_custom\" value=\"%s\" />\n",
$this->name, Convert::raw2xml($value)
)
. sprintf(
"<input type=\"hidden\" class=\"formatValidationURL\" value=\"%s\" />",
$this->Link() . '/validate'
);
$options .= ($value) ? sprintf( $options .= ($value) ? sprintf(
'<span class="preview">(%s: "%s")</span>', '<span class="preview">(%s: "%s")</span>',
_t('MemberDatetimeOptionsetField.Preview', 'Preview'), _t('MemberDatetimeOptionsetField.Preview', 'Preview'),
Zend_Date::now()->toString($value) Convert::raw2xml(Zend_Date::now()->toString($value))
) : ''; ) : '';
$options .= sprintf( $options .= sprintf(
'<a class="cms-help-toggle" href="#%s">%s</a>', '<a class="cms-help-toggle" href="#%s">%s</a>',