tonyair/silverstripe-framework
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-framework synced 2024-10-22 14:05:37 +02:00
Code Issues Projects Releases Wiki Activity

BUGFIX Fixed XSS in admin/security and "My Profile" forms

Browse Source
This commit is contained in:
Ingo Schommer 2013-01-04 16:47:50 +01:00
parent 7830b5d1b1
commit 7bb0bbff0e
1 changed files with 18 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
forms/MemberDatetimeOptionsetField.php
View File

@ -35,17 +35,27 @@ class MemberDatetimeOptionsetField extends OptionsetField {
$value = ($this->value && !array_key_exists($this->value, $this->source)) ? $this->value : null;
$checked = ($value) ? " checked=\"checked\"" : '';
$options .= "<li class=\"valCustom\">"
. sprintf("<input id=\"%s_custom\" name=\"%s\" type=\"radio\" value=\"__custom__\" class=\"radio\" %s />",
$itemID, $this->name, $checked)
. sprintf('<label for="%s_custom">%s:</label>',
$itemID, _t('MemberDatetimeOptionsetField.Custom', 'Custom'))
. sprintf("<input class=\"customFormat\" name=\"%s_custom\" value=\"%s\" />\n", $this->name, $value)
. sprintf("<input type=\"hidden\" class=\"formatValidationURL\" value=\"%s\" />",
$this->Link() . '/validate');
. sprintf(
"<input id=\"%s_custom\" name=\"%s\" type=\"radio\" value=\"__custom__\" class=\"radio\" %s />",
$itemID, $this->name,
$checked
)
. sprintf(
'<label for="%s_custom">%s:</label>',
$itemID, _t('MemberDatetimeOptionsetField.Custom', 'Custom')
)
. sprintf(
"<input class=\"customFormat\" name=\"%s_custom\" value=\"%s\" />\n",
$this->name, Convert::raw2xml($value)
)
. sprintf(
"<input type=\"hidden\" class=\"formatValidationURL\" value=\"%s\" />",
$this->Link() . '/validate'
);
$options .= ($value) ? sprintf(
'<span class="preview">(%s: "%s")</span>',
_t('MemberDatetimeOptionsetField.Preview', 'Preview'),
Zend_Date::now()->toString($value)
Convert::raw2xml(Zend_Date::now()->toString($value))
) : '';
$options .= sprintf(
'<a class="cms-help-toggle" href="#%s">%s</a>',