Update of /cvsroot/php-blog/serendipity In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv16673 Modified Files: Tag: branch_0_6 comment.php index.php serendipity_admin.php serendipity_admin_category.inc.php serendipity_admin_entries.inc.php serendipity_admin_image_selector.php serendipity_admin_installer.inc.php serendipity_admin_plugins.inc.php serendipity_entries.php serendipity_functions.inc.php serendipity_genpage.inc.php serendipity_layout_table.inc.php serendipity_sidebar_items.php Log Message: Use Content-Type headers for all pages (including admin area). Use htmlspecialchars() instead of htmlentities() to not encode native characters. Index: serendipity_admin_installer.inc.php =================================================================== RCS file: /cvsroot/php-blog/serendipity/serendipity_admin_installer.inc.php,v retrieving revision 1.59 retrieving revision 1.59.4.1 diff -u -d -r1.59 -r1.59.4.1 --- serendipity_admin_installer.inc.php 21 Mar 2004 16:35:31 -0000 1.59 +++ serendipity_admin_installer.inc.php 7 Apr 2004 12:38:18 -0000 1.59.4.1 @@ -119,7 +119,7 @@ break; case 'protected' : - echo '<input type="password" size="30" name="' . $name . '" value="' . htmlentities($value) . '" />'; + echo '<input type="password" size="30" name="' . $name . '" value="' . htmlspecialchars($value) . '" />'; break; case 'list' : preg_match_all("/([^\=]+)\=\>([^\,]+)\,?/i", $default, $res); @@ -133,7 +133,7 @@ echo '</select>'; break; default : - echo '<input type="text" size="30" name="' . $name . '" value="' . htmlentities($value) . '" />'; + echo '<input type="text" size="30" name="' . $name . '" value="' . htmlspecialchars($value) . '" />'; break; } } Index: serendipity_admin.php =================================================================== RCS file: /cvsroot/php-blog/serendipity/serendipity_admin.php,v retrieving revision 1.34 retrieving revision 1.34.4.1 diff -u -d -r1.34 -r1.34.4.1 --- serendipity_admin.php 21 Mar 2004 16:35:31 -0000 1.34 +++ serendipity_admin.php 7 Apr 2004 12:38:17 -0000 1.34.4.1 @@ -4,6 +4,7 @@ define('IN_installer', true); define('IN_upgrader', true); include('serendipity_config.inc.php'); +header('Content-Type: text/html; charset=' . LANG_CHARSET); if (isset($serendipity['GET']['adminModule']) && $serendipity['GET']['adminModule'] == 'logout'){ serendipity_logout(); @@ -16,6 +17,7 @@ <html> <head> <title><?php echo SERENDIPITY_ADMIN_SUITE; ?></title> + <meta http-equiv="Content-Type" content="text/html; charset=<?php echo LANG_CHARSET; ?>" /> <link rel="stylesheet" type="text/css" href="<?php echo (isset($serendipity['serendipityHTTPPath']) ? $serendipity['serendipityHTTPPath'] : ''); ?>serendipity.css.php" /> <?php if (!empty($serendipity['extCSS']) && strtolower($serendipity['extCSS']) != 'none') { Index: serendipity_entries.php =================================================================== RCS file: /cvsroot/php-blog/serendipity/serendipity_entries.php,v retrieving revision 1.27 retrieving revision 1.27.4.1 diff -u -d -r1.27 -r1.27.4.1 --- serendipity_entries.php 26 Mar 2004 16:47:22 -0000 1.27 +++ serendipity_entries.php 7 Apr 2004 12:38:18 -0000 1.27.4.1 @@ -10,6 +10,8 @@ $_SESSION['serendipityAuthedUser'] = true; } +header('Content-Type: text/html; charset=' . LANG_CHARSET); + if (isset($serendipity['GET']['adminModule']) && $serendipity['GET']['adminModule'] == 'logout'){ serendipity_logout(); } else { @@ -20,6 +22,7 @@ <html> <head> <title><?php echo SERENDIPITY_AUTHORING_SUITE; ?></title> + <meta http-equiv="Content-Type" content="text/html; charset=<?php echo LANG_CHARSET; ?>" /> <link rel="stylesheet" type="text/css" href="<?php echo $serendipity['serendipityHTTPPath']; ?>serendipity.css.php" /> <?php if (strtolower($serendipity['extCSS']) != 'none' && $serendipity['extCSS'] != '') { Index: serendipity_genpage.inc.php =================================================================== RCS file: /cvsroot/php-blog/serendipity/serendipity_genpage.inc.php,v retrieving revision 1.26 retrieving revision 1.26.4.1 diff -u -d -r1.26 -r1.26.4.1 --- serendipity_genpage.inc.php 21 Mar 2004 16:47:18 -0000 1.26 +++ serendipity_genpage.inc.php 7 Apr 2004 12:38:18 -0000 1.26.4.1 @@ -15,7 +15,8 @@ ?> <html> <head> - <title><?php echo htmlentities($serendipity['blogTitle']); ?></title> + <title><?php echo htmlspecialchars($serendipity['blogTitle']); ?></title> + <meta http-equiv="Content-Type" content="text/html; charset=<?php echo LANG_CHARSET; ?>" /> <meta name="Powered-By" content="Serendipity v.<?php echo $serendipity['version'] ?>" /> <link rel="stylesheet" type="text/css" href="<?php echo $serendipity['serendipityHTTPPath']; ?>serendipity.css.php" /> <link rel="alternate" type="application/rss+xml" title="RSS" href="<?php echo $serendipity['baseURL'] . ($serendipity['rewrite'] == 'none' ? $serendipity['indexFile'] . '?/' : ''); ?>feeds/index.rss2" /> Index: serendipity_admin_image_selector.php =================================================================== RCS file: /cvsroot/php-blog/serendipity/serendipity_admin_image_selector.php,v retrieving revision 1.18 retrieving revision 1.18.4.1 diff -u -d -r1.18 -r1.18.4.1 --- serendipity_admin_image_selector.php 3 Mar 2004 09:07:00 -0000 1.18 +++ serendipity_admin_image_selector.php 7 Apr 2004 12:38:18 -0000 1.18.4.1 @@ -16,6 +16,8 @@ die ("Don't hack!"); } +header('Content-Type: text/html; charset=' . LANG_CHARSET); + if ($_SESSION['serendipityAuthedUser'] !== true) { die(HAVE_TO_BE_LOGGED_ON); } @@ -24,6 +26,7 @@ <html> <head> <title><?php echo SELECT_IMAGE; ?></title> + <meta http-equiv="Content-Type" content="text/html; charset=<?php echo LANG_CHARSET; ?>" /> <link rel="stylesheet" type="text/css" href="<?php echo $serendipity['serendipityHTTPPath']; ?>serendipity.css.php"> </head> <body id="serendipity_admin_image_page"> Index: serendipity_layout_table.inc.php =================================================================== RCS file: /cvsroot/php-blog/serendipity/serendipity_layout_table.inc.php,v retrieving revision 1.10 retrieving revision 1.10.4.1 diff -u -d -r1.10 -r1.10.4.1 --- serendipity_layout_table.inc.php 21 Mar 2004 16:35:32 -0000 1.10 +++ serendipity_layout_table.inc.php 7 Apr 2004 12:38:18 -0000 1.10.4.1 @@ -14,7 +14,7 @@ ?> <div id="serendipity_banner"> - <h1><?php echo htmlentities($serendipity['blogTitle']) ; ?></h1> + <h1><?php echo htmlspecialchars($serendipity['blogTitle']) ; ?></h1> <?php $sub = isset($serendipity['blogSubTitle']) ? $serendipity['blogSubTitle'] : $serendipity['blogDescription']; if (strlen($sub)) { Index: index.php =================================================================== RCS file: /cvsroot/php-blog/serendipity/index.php,v retrieving revision 1.37 retrieving revision 1.37.4.1 diff -u -d -r1.37 -r1.37.4.1 --- index.php 21 Mar 2004 16:35:31 -0000 1.37 +++ index.php 7 Apr 2004 12:38:17 -0000 1.37.4.1 @@ -9,7 +9,8 @@ session_start(); include_once('serendipity_config.inc.php'); serendipity_login(); - +header('Content-Type: text/html; charset='. LANG_CHARSET); + $track_referer = true; $uri = $_SERVER['REQUEST_URI']; @@ -19,7 +20,6 @@ } if (preg_match(PAT_ARCHIVES, $uri, $matches)) { - header('Content-Type: text/html; charset='. LANG_CHARSET); $range = $matches[1]; $_GET['serendipity']['action'] = 'read'; $_GET['serendipity']['range'] = $range; @@ -45,7 +45,6 @@ echo $data; } else if (preg_match(PAT_ARCHIVES_SHORT, $uri, $matches)) { - header('Content-Type: text/html; charset='. LANG_CHARSET); $range = $matches[1]; $_GET['serendipity']['action'] = 'read'; $_GET['serendipity']['range'] = $range; @@ -91,7 +90,6 @@ } } - header('Content-Type: text/html; charset='. LANG_CHARSET); $id = $matches[1]; serendipity_track_referrer($id); @@ -146,15 +144,12 @@ header("Location: {$serendipity['serendipityHTTPPath']}serendipity_entries.php"); exit; } else if (preg_match(PAT_ARCHIVE, $uri)) { - header('Content-Type: text/html; charset='. LANG_CHARSET); $serendipity['GET']['action'] = 'archives'; include_once(S9Y_INCLUDE_PATH . 'serendipity_genpage.inc.php'); } else if (preg_match(PAT_CATEGORIES, $uri, $matches) || preg_match('@/(index\.(php|html))?@', $uri) || preg_match('@/(' . preg_quote($serendipity['indexFile']) . ')?@', $uri)) { - header('Content-Type: text/html; charset='. LANG_CHARSET); - if (count($serendipity['GET']) == 2) { if (isset($matches) && is_array($matches) && isset($matches[1])) { $serendipity['GET']['category'] = $matches[1]; Index: serendipity_functions.inc.php =================================================================== RCS file: /cvsroot/php-blog/serendipity/serendipity_functions.inc.php,v retrieving revision 1.248 retrieving revision 1.248.4.1 diff -u -d -r1.248 -r1.248.4.1 --- serendipity_functions.inc.php 2 Apr 2004 12:34:58 -0000 1.248 +++ serendipity_functions.inc.php 7 Apr 2004 12:38:18 -0000 1.248.4.1 @@ -842,7 +842,7 @@ } ?> - <h4 class="serendipity_title"><a href="<?php echo $entryLink; ?>"><?php echo htmlentities($entry['title']); ?></a></h4> + <h4 class="serendipity_title"><a href="<?php echo $entryLink; ?>"><?php echo htmlspecialchars($entry['title']); ?></a></h4> <div class="serendipity_entry"> <span class="<?php echo $extended_css; ?>"><?php echo $entry['body']; ?></span> @@ -850,7 +850,7 @@ <div class='serendipity_entryFooter'> <?php - echo ' ' . POSTED_BY . ' ' . htmlentities($entry['username']) . (!empty($entry['category_name']) ? ' ' . IN . ' <a href="' . $serendipity['serendipityHTTPPath'] . ($serendipity['rewrite'] == 'none' ? $serendipity['indexFile'] . '?/' : '') . 'categories/' . $entry['categoryid'] . '_' . serendipity_makeFilename($entry['category_name']) . '">' . $entry['category_name'] . '</a> ' : ' ') . AT . ' <a href="' . $entryLink . '">' . date('H:i', $entry['timestamp']) . '</a>'. "\n"; + echo ' ' . POSTED_BY . ' ' . htmlspecialchars($entry['username']) . (!empty($entry['category_name']) ? ' ' . IN . ' <a href="' . $serendipity['serendipityHTTPPath'] . ($serendipity['rewrite'] == 'none' ? $serendipity['indexFile'] . '?/' : '') . 'categories/' . $entry['categoryid'] . '_' . serendipity_makeFilename($entry['category_name']) . '">' . $entry['category_name'] . '</a> ' : ' ') . AT . ' <a href="' . $entryLink . '">' . date('H:i', $entry['timestamp']) . '</a>'. "\n"; if (serendipity_db_bool($entry['allow_comments']) || !isset($entry['allow_comments']) || $entry['comments'] > 0) { if (!isset($serendipity['GET']['id'])) { @@ -1087,7 +1087,7 @@ } $name = empty($comment['author']) ? ANONYMOUS : $comment['author']; - $temp = array('comment' => htmlentities(strip_tags($comment['body'])) ); + $temp = array('comment' => htmlspecialchars(strip_tags($comment['body'])) ); serendipity_plugin_api::hook_event('frontend_display', $temp); $body = $temp['comment']; @@ -1101,14 +1101,14 @@ <?php /* Link to the user's email */ if (!empty($comment['email'])) { - echo '<a href="mailto:' . htmlentities($comment['email']) . '" title="' . SEND_MAIL_TO . ' ' . htmlentities($name) . ' (' . $comment['email'] . ')">' . htmlentities($name) . '</a>'; + echo '<a href="mailto:' . htmlspecialchars($comment['email']) . '" title="' . SEND_MAIL_TO . ' ' . htmlspecialchars($name) . ' (' . $comment['email'] . ')">' . htmlspecialchars($name) . '</a>'; } else { - echo htmlentities($name); + echo htmlspecialchars($name); } /* Link to the user's website, if the URL is valid */ if ((!isset($comment['type']) || $comment['type'] != 'trackback') && !empty($comment['url']) && $comment['url'] != 'http://' && eregi('^http://', $comment['url'])) { - echo ' (<a href="' . str_replace('"', '"', $comment['url']) . '" ' . serendipity_xhtml_target('_blank') . ' title="' . htmlentities($comment['url']) . '">Link</a>)'; + echo ' (<a href="' . str_replace('"', '"', $comment['url']) . '" ' . serendipity_xhtml_target('_blank') . ' title="' . htmlspecialchars($comment['url']) . '">Link</a>)'; } /* Show when the entry was made */ @@ -1165,7 +1165,7 @@ <td class="serendipity_comment"> <a href="<?php echo strip_tags($link); ?>" <?php echo serendipity_xhtml_target('_blank'); ?>><?php echo $title; ?></a><br /> <b><?php echo EXCERPT; ?>: </b> - <?php echo htmlentities(strip_tags($comment['body'])); ?><br /> + <?php echo htmlspecialchars(strip_tags($comment['body'])); ?><br /> <div class="serendipity_comment_source"> <b>Weblog: </b> <?php echo strip_tags($name); ?><br /> <b><?php echo TRACKED; ?>: </b> <?php echo date('M d, h:i', $comment['timestamp']); ?> @@ -1984,9 +1984,9 @@ foreach ($cats as $cat_data) { $selected = (isset($entry['categoryid']) && $cat_data['categoryid'] == $entry['categoryid'] ? ' selected="selected"' : ''); $cat_list .= ' <option value="' . $cat_data['categoryid'] . '" ' . $selected . '>' - . htmlentities($cat_data['category_name']) + . htmlspecialchars($cat_data['category_name']) . ' - ' - . htmlentities($cat_data['category_description']) + . htmlspecialchars($cat_data['category_description']) . '</option>' . $n; } } @@ -2012,7 +2012,7 @@ <td colspan="2"> <table width="100%" cellspacing="0" cellpadding="0" border="0"> <tr> - <td><input type="text" name="serendipity[title]" value="<?php echo isset($entry['title']) ? htmlentities($entry['title']) : ''; ?>" size="72" /></td> + <td><input type="text" name="serendipity[title]" value="<?php echo isset($entry['title']) ? htmlspecialchars($entry['title']) : ''; ?>" size="72" /></td> <td align="right"><select name="serendipity[isdraft]"> <option value="false" <?php echo $draftP; ?>><?php echo PUBLISH; ?></option> <option value="true" <?php echo $draftD; ?>><?php echo DRAFT; ?></option> @@ -2079,7 +2079,7 @@ <tr> <td colspan="3"> - <textarea style="width: 100%" name="serendipity[body]" id="serendipity[body]" cols="80" rows="20"><?php echo isset($entry['body']) ? htmlentities($entry['body']) : ''; ?></textarea> + <textarea style="width: 100%" name="serendipity[body]" id="serendipity[body]" cols="80" rows="20"><?php echo isset($entry['body']) ? htmlspecialchars($entry['body']) : ''; ?></textarea> </td> </tr> @@ -2106,7 +2106,7 @@ <tr> <td colspan="3"> - <textarea style="width: 100%" name="serendipity[extended]" id="serendipity[extended]" cols="80" rows="20"><?php echo isset($entry['extended']) ? htmlentities($entry['extended']) : ''; ?></textarea> + <textarea style="width: 100%" name="serendipity[extended]" id="serendipity[extended]" cols="80" rows="20"><?php echo isset($entry['extended']) ? htmlspecialchars($entry['extended']) : ''; ?></textarea> </td> </tr> Index: serendipity_admin_plugins.inc.php =================================================================== RCS file: /cvsroot/php-blog/serendipity/serendipity_admin_plugins.inc.php,v retrieving revision 1.20.4.1 retrieving revision 1.20.4.2 diff -u -d -r1.20.4.1 -r1.20.4.2 --- serendipity_admin_plugins.inc.php 7 Apr 2004 06:53:12 -0000 1.20.4.1 +++ serendipity_admin_plugins.inc.php 7 Apr 2004 12:38:18 -0000 1.20.4.2 @@ -97,8 +97,8 @@ $bag = new serendipity_property_bag; $plugin->introspect($bag); - $name = htmlentities($bag->get('name')); - $desc = htmlentities($bag->get('description')); + $name = htmlspecialchars($bag->get('name')); + $desc = htmlspecialchars($bag->get('description')); if ($event_only) { $place = '<input type="hidden" name="serendipity[placement][' . $plugin_data['name'] . ']" value="event" />'; } else { @@ -217,8 +217,8 @@ $bag = new serendipity_property_bag; $plugin->introspect($bag); - $name = htmlentities($bag->get('name')); - $desc = htmlentities($bag->get('description')); + $name = htmlspecialchars($bag->get('name')); + $desc = htmlspecialchars($bag->get('description')); $config_names = $bag->get('configuration'); @@ -254,10 +254,10 @@ $cbag = new serendipity_property_bag; $plugin->introspect_config_item($config_item, $cbag); - $cname = htmlentities($cbag->get('name')); - $cdesc = htmlentities($cbag->get('description')); + $cname = htmlspecialchars($cbag->get('name')); + $cdesc = htmlspecialchars($cbag->get('description')); $value = $plugin->get_config($config_item); - $hvalue = (isset($_POST['serendipity']['plugin'][$config_item]) ? htmlentities($_POST['serendipity']['plugin'][$config_item]) : htmlentities($value)); + $hvalue = (isset($_POST['serendipity']['plugin'][$config_item]) ? htmlspecialchars($_POST['serendipity']['plugin'][$config_item]) : htmlspecialchars($value)); $radio = array(); $select = array(); @@ -288,8 +288,8 @@ foreach($select AS $select_value => $select_desc) { $id = htmlspecialchars($config_item . $select_value); ?> - <option value="<?php echo $select_value; ?>" <?php echo ($select_value == $hvalue ? 'selected="selected"' : ''); ?> title="<?php echo htmlentities($select_desc); ?>" /> - <?php echo htmlentities($select_desc); ?> + <option value="<?php echo $select_value; ?>" <?php echo ($select_value == $hvalue ? 'selected="selected"' : ''); ?> title="<?php echo htmlspecialchars($select_desc); ?>" /> + <?php echo htmlspecialchars($select_desc); ?> </option> <?php } @@ -340,8 +340,8 @@ <?php } ?> - <input type="radio" id="serendipity_plugin_<?php echo $id; ?>" name="serendipity[plugin][<?php echo $config_item; ?>]" value="<?php echo $radio_value; ?>" <?php echo ($radio_value == $hvalue ? 'checked="checked"' : ''); ?> title="<?php echo htmlentities($radio['desc'][$radio_index]); ?>" /> - <label for="serendipity_plugin_<?php echo $id; ?>"><?php echo htmlentities($radio['desc'][$radio_index]); ?></label> + <input type="radio" id="serendipity_plugin_<?php echo $id; ?>" name="serendipity[plugin][<?php echo $config_item; ?>]" value="<?php echo $radio_value; ?>" <?php echo ($radio_value == $hvalue ? 'checked="checked"' : ''); ?> title="<?php echo htmlspecialchars($radio['desc'][$radio_index]); ?>" /> + <label for="serendipity_plugin_<?php echo $id; ?>"><?php echo htmlspecialchars($radio['desc'][$radio_index]); ?></label> <?php if ($counter == $per_row) { $counter = 0; Index: serendipity_sidebar_items.php =================================================================== RCS file: /cvsroot/php-blog/serendipity/serendipity_sidebar_items.php,v retrieving revision 1.52 retrieving revision 1.52.4.1 diff -u -d -r1.52 -r1.52.4.1 --- serendipity_sidebar_items.php 1 Apr 2004 14:19:01 -0000 1.52 +++ serendipity_sidebar_items.php 7 Apr 2004 12:38:18 -0000 1.52.4.1 @@ -527,12 +527,12 @@ '<a href="%s" title="%s">%s</a><br />', $serendipity['serendipityHTTPPath'] . 'rss.php?category=' . $category['categoryid'] . '_' . $category_id, - htmlentities($category['category_description']), + htmlspecialchars($category['category_description']), ($serendipity['XHTML11'] ? 'style="display: inline; border: 0px"' : 'border="0"'), serendipity_getTemplateFile('img/xml.gif'), $serendipity['serendipityHTTPPath'] . ($serendipity['rewrite'] == 'none' ? $serendipity['indexFile'] . '?/' : '') . PATH_CATEGORIES.'/' . $category['categoryid'] . '_' . $category_id, - htmlentities($category['category_description']), - htmlentities($category['category_name']) + htmlspecialchars($category['category_description']), + htmlspecialchars($category['category_name']) ); } } Index: comment.php =================================================================== RCS file: /cvsroot/php-blog/serendipity/comment.php,v retrieving revision 1.30 retrieving revision 1.30.4.1 diff -u -d -r1.30 -r1.30.4.1 --- comment.php 3 Mar 2004 09:07:00 -0000 1.30 +++ comment.php 7 Apr 2004 12:38:17 -0000 1.30.4.1 @@ -4,6 +4,7 @@ session_start(); include_once('serendipity_config.inc.php'); +header('Content-Type: text/html; charset=' . LANG_CHARSET); if (isset($serendipity['GET']['delete'], $serendipity['GET']['entry'], $serendipity['GET']['type'])) { serendipity_deleteComment($serendipity['GET']['delete'], $serendipity['GET']['entry'], $serendipity['GET']['type']); @@ -53,6 +54,7 @@ <head> <title>' . COMMENTS . '</title> <link rel="stylesheet" type="text/css" href="' . $serendipity['serendipityHTTPPath'] . 'serendipity.css.php?mode=comments" /> + <meta http-equiv="Content-Type" content="text/html; charset=<?php echo LANG_CHARSET; ?>" /> </head> <body id="serendipity_comment_page"> '; Index: serendipity_admin_category.inc.php =================================================================== RCS file: /cvsroot/php-blog/serendipity/serendipity_admin_category.inc.php,v retrieving revision 1.8 retrieving revision 1.8.14.1 diff -u -d -r1.8 -r1.8.14.1 --- serendipity_admin_category.inc.php 18 Sep 2003 12:58:00 -0000 1.8 +++ serendipity_admin_category.inc.php 7 Apr 2004 12:38:17 -0000 1.8.14.1 @@ -47,11 +47,11 @@ if ($cat_to_edit > 0 && $cat_data['categoryid'] == $cat_to_edit && !isset($this_cat)) { $this_cat = $cat_data; } elseif ($cat_to_edit > 0) { - $existing_cats_dropdown .= '<option value="' . $cat_data['categoryid'] . '">' . htmlentities($cat_data['category_name']) . '</option>' . "\n"; + $existing_cats_dropdown .= '<option value="' . $cat_data['categoryid'] . '">' . htmlspecialchars($cat_data['category_name']) . '</option>' . "\n"; } - $name = htmlentities($cat_data['category_name']); - $desc = htmlentities($cat_data['category_description']); + $name = htmlspecialchars($cat_data['category_name']); + $desc = htmlspecialchars($cat_data['category_description']); $existing_cats_table .= <<<CAT <tr> <td> @@ -73,7 +73,7 @@ $save = CREATE; $remove = ''; } else { - $desc = htmlentities(sprintf(EDIT_THIS_CAT, $this_cat['category_name'], $this_cat['category_description'])); + $desc = htmlspecialchars(sprintf(EDIT_THIS_CAT, $this_cat['category_name'], $this_cat['category_description'])); $save = SAVE; $remove = '<br /><br /><font size="1">' . sprintf(CATEGORY_REMAINING, $existing_cats_dropdown) .' <input type="submit" name="REMOVE" value="> "></font>'; } @@ -83,12 +83,12 @@ <table cellpadding="5"> <tr> <th><?php echo NAME; ?></th> - <td><input type="text" name="serendipity[cat][name]" value="<?php echo isset($this_cat['category_name']) ? htmlentities($this_cat['category_name']) : ''; ?>" /></td> + <td><input type="text" name="serendipity[cat][name]" value="<?php echo isset($this_cat['category_name']) ? htmlspecialchars($this_cat['category_name']) : ''; ?>" /></td> </tr> <tr> <th><?php echo DESCRIPTION; ?></th> - <td><input type="text" name="serendipity[cat][description]" value="<?php echo isset($this_cat['category_description']) ? htmlentities($this_cat['category_description']) : ''; ?>" /></td> + <td><input type="text" name="serendipity[cat][description]" value="<?php echo isset($this_cat['category_description']) ? htmlspecialchars($this_cat['category_description']) : ''; ?>" /></td> </tr> </table> Index: serendipity_admin_entries.inc.php =================================================================== RCS file: /cvsroot/php-blog/serendipity/serendipity_admin_entries.inc.php,v retrieving revision 1.19 retrieving revision 1.19.4.1 diff -u -d -r1.19 -r1.19.4.1 --- serendipity_admin_entries.inc.php 21 Mar 2004 16:35:31 -0000 1.19 +++ serendipity_admin_entries.inc.php 7 Apr 2004 12:38:18 -0000 1.19.4.1 @@ -80,7 +80,7 @@ <br /> <?php if ($entries[$x]['isdraft'] == 'true') echo DRAFT . ':'; ?> <a href="?serendipity[action]=admin&serendipity[adminModule]=entries&serendipity[adminAction]=<?php echo $action; ?>&serendipity[id]=<?php echo $entries[$x]['id']; ?>" title="#<?php echo $entries[$x]['id']; ?>"> - <?php echo htmlentities(substr(empty($entries[$x]['title']) ? $entries[$x]['body'] : $entries[$x]['title'], 0, 40)); ?> + <?php echo htmlspecialchars(substr(empty($entries[$x]['title']) ? $entries[$x]['body'] : $entries[$x]['title'], 0, 40)); ?> </a> </td> @@ -92,7 +92,7 @@ <br /> <?php if ($entries[$x + $half]['isdraft'] == 'true') echo DRAFT . ':'; ?> <a href="?serendipity[action]=admin&serendipity[adminModule]=entries&serendipity[adminAction]=<?php echo $action; ?>&serendipity[id]=<?php echo $entries[$x + $half]['id']; ?>" title="#<?php echo $entries[$x + $half]['id']; ?>"> - <?php echo htmlentities(substr(empty($entries[$x + $half]['title']) ? $entries[$x + $half]['body'] : $entries[$x + $half]['title'], 0, 40)); ?> + <?php echo htmlspecialchars(substr(empty($entries[$x + $half]['title']) ? $entries[$x + $half]['body'] : $entries[$x + $half]['title'], 0, 40)); ?> </a> <?php } |
