diff --git a/src/Module/Contact.php b/src/Module/Contact.php index ec7e89692..66e8c97fd 100644 --- a/src/Module/Contact.php +++ b/src/Module/Contact.php @@ -85,7 +85,7 @@ class Contact extends BaseModule /// @TODO Add nice spaces $vcard_widget = Renderer::replaceMacros(Renderer::getMarkupTemplate('vcard-widget.tpl'), [ - '$name' => htmlentities($contact['name']), + '$name' => $contact['name'], '$photo' => $contact['photo'], '$url' => Model\Contact::MagicLink($contact['url']), '$addr' => defaults($contact, 'addr', ''), @@ -639,7 +639,7 @@ class Contact extends BaseModule '$ffi_keyword_blacklist' => $contact['ffi_keyword_blacklist'], '$ffi_keyword_blacklist' => ['ffi_keyword_blacklist', L10n::t('Blacklisted keywords'), $contact['ffi_keyword_blacklist'], L10n::t('Comma separated list of keywords that should not be converted to hashtags, when "Fetch information and keywords" is selected')], '$photo' => $contact['photo'], - '$name' => htmlentities($contact['name']), + '$name' => $contact['name'], '$dir_icon' => $dir_icon, '$sparkle' => $sparkle, '$url' => $url, @@ -1033,14 +1033,14 @@ class Contact extends BaseModule 'alt_text' => $alt_text, 'dir_icon' => $dir_icon, 'thumb' => ProxyUtils::proxifyUrl($rr['thumb'], false, ProxyUtils::SIZE_THUMB), - 'name' => htmlentities($rr['name']), - 'username' => htmlentities($rr['name']), + 'name' => $rr['name'], + 'username' => $rr['name'], 'account_type' => Model\Contact::getAccountType($rr), 'sparkle' => $sparkle, 'itemurl' => defaults($rr, 'addr', $rr['url']), 'url' => $url, 'network' => ContactSelector::networkToName($rr['network'], $rr['url']), - 'nick' => htmlentities($rr['nick']), + 'nick' => $rr['nick'], ]; } diff --git a/src/Object/Post.php b/src/Object/Post.php index e7a9e6b02..50d903f02 100644 --- a/src/Object/Post.php +++ b/src/Object/Post.php @@ -213,7 +213,7 @@ class Post extends BaseObject $filer = (($conv->getProfileOwner() == local_user() && ($item['uid'] != 0)) ? L10n::t("save to folder") : false); - $profile_name = htmlentities($item['author-name']); + $profile_name = $item['author-name']; if (!empty($item['author-link']) && empty($item['author-name'])) { $profile_name = $item['author-link']; } @@ -377,7 +377,7 @@ class Post extends BaseObject 'isevent' => $isevent, 'attend' => $attend, 'linktitle' => L10n::t('View %s\'s profile @ %s', $profile_name, $item['author-link']), - 'olinktitle' => L10n::t('View %s\'s profile @ %s', htmlentities($this->getOwnerName()), $item['owner-link']), + 'olinktitle' => L10n::t('View %s\'s profile @ %s', $this->getOwnerName(), $item['owner-link']), 'to' => L10n::t('to'), 'via' => L10n::t('via'), 'wall' => L10n::t('Wall-to-Wall'), @@ -399,7 +399,7 @@ class Post extends BaseObject 'shiny' => $shiny, 'owner_url' => $this->getOwnerUrl(), 'owner_photo' => $a->removeBaseURL(ProxyUtils::proxifyUrl($item['owner-avatar'], false, ProxyUtils::SIZE_THUMB)), - 'owner_name' => htmlentities($owner_name_e), + 'owner_name' => $owner_name_e, 'plink' => Item::getPlink($item), 'edpost' => $edpost, 'isstarred' => $isstarred, diff --git a/view/templates/admin/addon_details.tpl b/view/templates/admin/addon_details.tpl index fb908b705..96b26d2d0 100644 --- a/view/templates/admin/addon_details.tpl +++ b/view/templates/admin/addon_details.tpl @@ -18,7 +18,7 @@

{{if $screenshot}} - {{$screenshot.1}} + {{$screenshot.1|escape}} {{/if}} {{if $admin_form}} diff --git a/view/templates/admin/contactblock.tpl b/view/templates/admin/contactblock.tpl index 152550f01..c9bfc2efd 100644 --- a/view/templates/admin/contactblock.tpl +++ b/view/templates/admin/contactblock.tpl @@ -32,10 +32,10 @@ {{foreach $contacts as $contact}} - {{$contact.nickname}} + {{$contact.nickname|escape}} {{$contact.name}} {{$contact.addr}} - {{$contact.url}} + {{$contact.url}} {{/foreach}} diff --git a/view/templates/admin/users.tpl b/view/templates/admin/users.tpl index b2b0d615a..f06b0f973 100644 --- a/view/templates/admin/users.tpl +++ b/view/templates/admin/users.tpl @@ -35,8 +35,8 @@ {{$u.email}} - - + + @@ -79,8 +79,8 @@ {{foreach $users as $u}} - {{$u.nickname}} - {{$u.name}} + {{$u.nickname|escape}} + {{$u.name}} {{$u.email}} {{$u.register_date}} {{$u.login_date}} @@ -94,8 +94,8 @@ {{/if}} {{if $u.is_deletable}} - - + + {{else}}   {{/if}} @@ -122,8 +122,8 @@ {{foreach $deleted as $u}} - {{$u.nickname}} - {{$u.name}} + {{$u.nickname|escape}} + {{$u.name}} {{$u.email}} {{$u.register_date}} {{$u.login_date}} diff --git a/view/templates/hovercard.tpl b/view/templates/hovercard.tpl index 7bf37e74b..74f270005 100644 --- a/view/templates/hovercard.tpl +++ b/view/templates/hovercard.tpl @@ -3,12 +3,12 @@
- {{$profile.name}} + {{$profile.name|escape}}
-

{{$profile.name}}

{{if $profile.account_type}}{{$profile.account_type}}{{/if}} +

{{$profile.name|escape}}

{{if $profile.account_type}}{{$profile.account_type}}{{/if}}
{{$profile.addr}} @@ -21,13 +21,13 @@ {{* here are the differnt actions like privat message, poke, delete and so on *}} {{* @todo we have two different photo menus one for contacts and one for items at the network stream. We currently use the contact photo menu, so the items options are missing We need to move them *}}
- {{if $profile.actions.pm}}{{/if}} - {{if $profile.actions.poke}}{{/if}} + {{if $profile.actions.pm}}{{/if}} + {{if $profile.actions.poke}}{{/if}}
- {{if $profile.actions.network}}{{/if}} - {{if $profile.actions.edit}}{{/if}} - {{if $profile.actions.follow}}{{/if}} + {{if $profile.actions.network}}{{/if}} + {{if $profile.actions.edit}}{{/if}} + {{if $profile.actions.follow}}{{/if}}
diff --git a/view/templates/profile_vcard.tpl b/view/templates/profile_vcard.tpl index b56dd607c..6f8e86b29 100644 --- a/view/templates/profile_vcard.tpl +++ b/view/templates/profile_vcard.tpl @@ -1,16 +1,16 @@
-
{{$profile.name}}
+
{{$profile.name|escape}}
{{if $profile.addr}}
{{$profile.addr}}
{{/if}} {{if $profile.pdesc}}
{{$profile.pdesc}}
{{/if}} {{if $profile.picdate}} -
{{$profile.name}}
+
{{$profile.name|escape}}
{{else}} -
{{$profile.name}}
+
{{$profile.name|escape}}
{{/if}} {{if $account_type}}{{/if}} {{if $profile.network_name}}
{{$network}}
{{$profile.network_name}}
{{/if}} diff --git a/view/templates/vcard-widget.tpl b/view/templates/vcard-widget.tpl index 47b64b68d..eed94193f 100644 --- a/view/templates/vcard-widget.tpl +++ b/view/templates/vcard-widget.tpl @@ -1,14 +1,14 @@
-
{{$name}}
- {{if $addr}}
{{$addr}}
{{/if}} +
{{$name|escape}}
+ {{if $addr}}
{{$addr|escape}}
{{/if}} {{if $pdesc}}
{{$pdesc}}
{{/if}} {{if $url}} -
{{$name}}
+
{{$name|escape}}
{{else}} -
{{$name}}
+
{{$name|escape}}
{{/if}} - {{if $account_type}}{{/if}} + {{if $account_type}}{{/if}} {{if $network_name}}
{{$network}}
{{$network_name}}
{{/if}}
diff --git a/view/templates/wall_thread.tpl b/view/templates/wall_thread.tpl index a82efa7d1..63a8364f8 100644 --- a/view/templates/wall_thread.tpl +++ b/view/templates/wall_thread.tpl @@ -19,15 +19,15 @@ {{if $item.owner_url}}
- {{$item.owner_name}} + {{$item.owner_name|escape}}
-
{{$item.wall}}
+
{{$item.wall|escape}}
{{/if}}
- {{$item.name}} + {{$item.name|escape}} menu
    @@ -38,7 +38,7 @@
- {{if $item.lock}}
{{$item.lock}}
+ {{if $item.lock}}
{{$item.lock|escape}}
{{else}}
{{/if}}
{{$item.location}}
diff --git a/view/templates/widget_forumlist.tpl b/view/templates/widget_forumlist.tpl index 32da71f81..da30967cd 100644 --- a/view/templates/widget_forumlist.tpl +++ b/view/templates/widget_forumlist.tpl @@ -21,8 +21,8 @@ function showHideForumlist() { {{if $forum.id <= $visible_forums}} @@ -31,8 +31,8 @@ function showHideForumlist() { {{if $forum.id > $visible_forums}} diff --git a/view/theme/duepuntozero/templates/profile_vcard.tpl b/view/theme/duepuntozero/templates/profile_vcard.tpl index 186b7e449..505cf560e 100644 --- a/view/theme/duepuntozero/templates/profile_vcard.tpl +++ b/view/theme/duepuntozero/templates/profile_vcard.tpl @@ -1,12 +1,12 @@
-
{{$profile.name}}
+
{{$profile.name|escape}}
{{if $profile.addr}}
{{$profile.addr}}
{{/if}} {{if $profile.pdesc}}
{{$profile.pdesc}}
{{/if}} -
{{$profile.name}}
+
{{$profile.name|escape}}
{{if $account_type}}{{/if}} diff --git a/view/theme/frio/templates/admin/addons.tpl b/view/theme/frio/templates/admin/addons.tpl index 220abdc2c..38efb62bd 100644 --- a/view/theme/frio/templates/admin/addons.tpl +++ b/view/theme/frio/templates/admin/addons.tpl @@ -12,7 +12,7 @@
  • - {{$p.2.name}} - {{$p.2.version}} + {{$p.2.name|escape}} - {{$p.2.version}} {{if $p.2.experimental}} {{$experimental}} {{/if}}{{if $p.2.unsupported}} {{$unsupported}} {{/if}}
    {{$p.2.description}}
    • diff --git a/view/theme/frio/templates/admin/contactblock.tpl b/view/theme/frio/templates/admin/contactblock.tpl index 3173c238b..3ac9a2517 100644 --- a/view/theme/frio/templates/admin/contactblock.tpl +++ b/view/theme/frio/templates/admin/contactblock.tpl @@ -67,9 +67,9 @@
    - {{$contact.nickname}} - {{$contact.name}} - {{$contact.url}} + {{$contact.nickname|escape}} + {{$contact.name|escape}} + {{$contact.url|escape}} {{/foreach}} @@ -78,7 +78,7 @@ {{* Checkbox to select all blocked contacts *}}
    - +
    diff --git a/view/theme/frio/templates/admin/queue.tpl b/view/theme/frio/templates/admin/queue.tpl index dde386399..3ebe89052 100644 --- a/view/theme/frio/templates/admin/queue.tpl +++ b/view/theme/frio/templates/admin/queue.tpl @@ -13,12 +13,12 @@ {{foreach $entries as $e}} - {{$e.id}} - {{$e.name}} - {{$e.nurl}} - {{$e.network}} - {{$e.created}} - {{$e.last}} + {{$e.id|escape}} + {{$e.name|escape}} + {{$e.nurl|escape}} + {{$e.network|escape}} + {{$e.created|escape}} + {{$e.last|escape}} {{/foreach}} diff --git a/view/theme/frio/templates/admin/summary.tpl b/view/theme/frio/templates/admin/summary.tpl index 66afda721..c2bbf49a7 100644 --- a/view/theme/frio/templates/admin/summary.tpl +++ b/view/theme/frio/templates/admin/summary.tpl @@ -54,14 +54,14 @@ {{* The Friendica version. *}}
    -
    {{$version.0}}
    -
    {{$platform}} '{{$codename}}' {{$version.1}} - {{$build}}
    +
    {{$version.0|escape}}
    +
    {{$platform}} '{{$codename|escape}}' {{$version.1|escape}} - {{$build|escape}}
    {{* Server Settings. *}}
    -
    {{$serversettings.label}}
    +
    {{$serversettings.label|escape}}
    diff --git a/view/theme/frio/templates/admin/users.tpl b/view/theme/frio/templates/admin/users.tpl index 92ef9be6f..031ffd0a4 100644 --- a/view/theme/frio/templates/admin/users.tpl +++ b/view/theme/frio/templates/admin/users.tpl @@ -46,11 +46,11 @@ - + {{if $u.note}} @@ -145,8 +145,8 @@   {{/if}} - - + + {{if $order_users == $th_users.2.1}} @@ -169,18 +169,18 @@ {{if $u.page_flags_raw==3}}fa-heart{{/if}} {{* PAGE_FREELOVE *}} {{if $u.page_flags_raw==4}}fa-rss{{/if}} {{* PAGE_BLOG *}} {{if $u.page_flags_raw==5}}fa-user-secret{{/if}} {{* PAGE_PRVGROUP *}} - " title="{{$u.page_flags}}"> + " title="{{$u.page_flags|escape}}"> {{if $u.page_flags_raw==0 && $u.account_type_raw > 0}} {{/if}} - {{if $u.is_admin}}{{/if}} - {{if $u.account_expired}}{{/if}} + {{if $u.is_admin}}{{/if}} + {{if $u.account_expired}}{{/if}} {{/if}} @@ -229,7 +229,7 @@ {{/if}} - + {{else}} @@ -297,8 +297,8 @@ {{foreach $deleted as $u}} - - + + diff --git a/view/theme/frio/templates/comment_item.tpl b/view/theme/frio/templates/comment_item.tpl index 4ef5f2caa..804d07ac0 100644 --- a/view/theme/frio/templates/comment_item.tpl +++ b/view/theme/frio/templates/comment_item.tpl @@ -33,37 +33,37 @@ {{/if}}
    • -
    • -
    • -
    • -
    • -
    • -
    • -
      • diff --git a/view/theme/frio/templates/common_tabs.tpl b/view/theme/frio/templates/common_tabs.tpl index 76c6db039..207ffefcb 100644 --- a/view/theme/frio/templates/common_tabs.tpl +++ b/view/theme/frio/templates/common_tabs.tpl @@ -6,7 +6,7 @@
      • @@ -31,7 +31,7 @@ @@ -35,35 +35,35 @@
      - {{$contact_status}} + {{$contact_status|escape}} {{* Block with status information about the contact *}}
        - {{if $relation_text}}
      • {{$relation_text}}
        • {{/if}} - {{if $nettype}}
      • {{$nettype}}
        • {{/if}} + {{if $relation_text}}
      • {{$relation_text|escape}}
        • {{/if}} + {{if $nettype}}
      • {{$nettype|escape}}
        • {{/if}} {{if $poll_enabled}} -
      • {{$lastupdtext}} {{$last_update}}
        +
      • {{$lastupdtext|escape}} {{$last_update|escape}}
        {{if $poll_interval}}
        - {{$updpub}} {{$poll_interval}} + {{$updpub|escape}} {{$poll_interval}} {{/if}}
        • {{/if}} - {{if $lost_contact}}
      • {{$lost_contact}}
        • {{/if}} - {{if $insecure}}
      • {{$insecure}}
        • {{/if}} - {{if $blocked && !$pending}}
      • {{$blocked}}
        • {{/if}} - {{if $pending}}
      • {{$pending}}
        • {{/if}} - {{if $ignored}}
      • {{$ignored}}
        • {{/if}} - {{if $archived}}
      • {{$archived}}
        • {{/if}} + {{if $lost_contact}}
      • {{$lost_contact|escape}}
        • {{/if}} + {{if $insecure}}
      • {{$insecure|escape}}
        • {{/if}} + {{if $blocked && !$pending}}
      • {{$blocked|escape}}
        • {{/if}} + {{if $pending}}
      • {{$pending|escape}}
        • {{/if}} + {{if $ignored}}
      • {{$ignored|escape}}
        • {{/if}} + {{if $archived}}
      • {{$archived|escape}}
        • {{/if}}
      {{* End of contact-edit-status-wrapper *}} @@ -83,38 +83,38 @@
      -
      {{$profileurllabel}}
      {{$profileurl}} +
      {{$profileurllabel|escape}}
      {{$profileurl|escape}}
      {{if $location}}
      -
      {{$location_label}}
      -
      {{$location}}
      +
      {{$location_label|escape}}
      +
      {{$location|escape}}
      {{/if}} {{if $xmpp}}
      -
      {{$xmpp_label}}
      -
      {{$xmpp}}
      +
      {{$xmpp_label|escape}}
      +
      {{$xmpp|escape}}
      {{/if}} {{if $keywords}}
      -
      {{$keywords_label}}
      -
      {{$keywords}}
      +
      {{$keywords_label|escape}}
      +
      {{$keywords|escape}}
      {{/if}} {{if $about}}
      -
      {{$about_label}}
      -
      {{$about}}
      +
      {{$about_label|escape}}
      +
      {{$about|escape}}
      {{/if}}
      @@ -127,14 +127,14 @@
      - + {{include file="field_checkbox.tpl" field=$notify}} {{if $fetch_further_information}} @@ -144,7 +144,7 @@ {{include file="field_checkbox.tpl" field=$hidden}}
      - +
      @@ -157,7 +157,7 @@ @@ -167,11 +167,11 @@ {{include file="field_textarea.tpl" field=$cinfo}}
      - +
      {{if $reason}} -

      {{$lbl_info2}}

      +

      {{$lbl_info2|escape}}

      {{$reason}}

      {{/if}} @@ -184,7 +184,7 @@ @@ -192,7 +192,7 @@
      {{if $profile_select}}
      -

      {{$lbl_vis2}}

      +

      {{$lbl_vis2|escape}}

      {{$profile_select}} @@ -201,7 +201,7 @@ {{/if}}
      - +
      diff --git a/view/theme/frio/templates/contact_template.tpl b/view/theme/frio/templates/contact_template.tpl index e1c0a7700..4f07ad2b1 100644 --- a/view/theme/frio/templates/contact_template.tpl +++ b/view/theme/frio/templates/contact_template.tpl @@ -6,14 +6,14 @@
      {{* For very small displays we use a drobdown menu for contact relating actions *}} {{/if}} {{if $contact.photo_menu.poke}} - {{/if}} {{if $contact.photo_menu.network}} - + {{/if}} {{if $contact.photo_menu.edit}} - + {{/if}} {{if $contact.photo_menu.drop}} - {{/if}} {{if $contact.photo_menu.follow}} - + {{/if}} {{if $contact.photo_menu.hide}} - + {{/if}} @@ -84,7 +84,7 @@ {{* The button to add or remove contacts from a contact group - group edit page *}} {{if $contact.change_member}}
      - {/if} {if $photo_menu.poke} - {/if} {if $photo_menu.network} - + {/if} {if $photo_menu.edit} - + {/if} {if $photo_menu.drop} - + {/if} {if $photo_menu.follow} - + {/if} @@ -207,7 +207,7 @@ We use this part to filter the contacts with jquery.textcomplete *}} {{* The button to add or remove contacts from a contact group - group edit page *}} {if $contact.change_member}
      - {{/if}} - {{if $event.copy}}{{/if}} - {{if $event.drop}}{{/if}} - {{if $event.item.plink}}{{/if}} + {{if $event.edit}}{{/if}} + {{if $event.copy}}{{/if}} + {{if $event.drop}}{{/if}} + {{if $event.item.plink}}{{/if}}
      diff --git a/view/theme/frio/templates/event_stream_item.tpl b/view/theme/frio/templates/event_stream_item.tpl index 87c2e70ca..58f39a0ee 100644 --- a/view/theme/frio/templates/event_stream_item.tpl +++ b/view/theme/frio/templates/event_stream_item.tpl @@ -17,16 +17,16 @@ {{if $location.map}}{{/if}}
      - {{$start_short}} - {{if $finish}} - {{if $same_date}}{{$end_time}}{{else}}{{$end_short}}{{/if}}{{/if}} + {{$start_short}} + {{if $finish}} - {{if $same_date}}{{$end_time}}{{else}}{{$end_short}}{{/if}}{{/if}} {{if $location.name}} - {{$location.name}} + {{$location.name|escape}} {{/if}}
      - {{$author_name}} + {{$author_name|escape}}
      {{if $location.map}}
      {{$location.map}}
      diff --git a/view/theme/frio/templates/events_js.tpl b/view/theme/frio/templates/events_js.tpl index a4ca9004c..3866282a3 100644 --- a/view/theme/frio/templates/events_js.tpl +++ b/view/theme/frio/templates/events_js.tpl @@ -5,7 +5,7 @@ {{* The link to create a new event *}} {{if $new_event.0}} @@ -40,9 +40,9 @@ {{* The buttons to change the month/weeks/days *}}
      - - - + + +
      {{* The title (e.g. name of the mont/week/day) *}} diff --git a/view/theme/frio/templates/filebrowser.tpl b/view/theme/frio/templates/filebrowser.tpl index d452810c8..ce58ef0b9 100644 --- a/view/theme/frio/templates/filebrowser.tpl +++ b/view/theme/frio/templates/filebrowser.tpl @@ -9,8 +9,8 @@
      - - + + -

      {{$fullname}}

      +

      {{$fullname|escape}}

      {{$str_notifytype}} {{$notify_type}}
      {{* if the contact was suggestested by another contact, the contact who made the suggestion is displayed*}} {{if $madeby}}
      {{$lbl_madeby}} {{$madeby}}
      {{/if}} @@ -51,7 +51,7 @@ a bootstrap modal in the case of approval *}} diff --git a/view/theme/frio/templates/mail_conv.tpl b/view/theme/frio/templates/mail_conv.tpl index 2ad989849..b5154aa4c 100644 --- a/view/theme/frio/templates/mail_conv.tpl +++ b/view/theme/frio/templates/mail_conv.tpl @@ -2,13 +2,13 @@
      - {{$mail.from_name}} + {{$mail.from_name|escape}}
      {{$mail.date}}
      -

      {{$mail.from_name}}

      +

      {{$mail.from_name|escape}}

      {{$mail.body}} diff --git a/view/theme/frio/templates/mail_list.tpl b/view/theme/frio/templates/mail_list.tpl index 4a797d47c..225fd71c1 100644 --- a/view/theme/frio/templates/mail_list.tpl +++ b/view/theme/frio/templates/mail_list.tpl @@ -5,7 +5,7 @@
      - {{$from_name}} + {{$from_name|escape}}
      diff --git a/view/theme/frio/templates/nav.tpl b/view/theme/frio/templates/nav.tpl index d64eae9c4..6f20c247c 100644 --- a/view/theme/frio/templates/nav.tpl +++ b/view/theme/frio/templates/nav.tpl @@ -40,37 +40,37 @@
    {{$u.created}}{{$u.name}}{{$u.name|escape}} {{$u.email}} - - + +
    {{$u.name}} {{$u.name|escape}} {{$u.email}}{{$u.register_date}}
    {{$u.name}}{{$u.name|escape}} {{$u.email}} {{$u.deleted}}