projects / mir.git / blobdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | inline | side by side
wrap pretty much all freemarker variables (i.e the data) in encodeHTML(data..). this...
[mir.git] / templates-dist / admin / message.template
diff --git a/templates-dist/admin/message.template b/templates-dist/admin/message.template
index 9be97e2..4aa3305 100755 (executable)
--- a/templates-dist/admin/message.template
+++ b/templates-dist/admin/message.template
@@ -7,9 +7,9 @@ ${lang("message.htmltitle")}
 
 <body bgcolor="#FFFFFF">
 <include "admin/head.template">
-<form action="${config.actionRoot}" method="post">
+<form action="${encodeHTML(config.actionRoot)}" method="post">
        <input type="hidden" name="module" value="Message">
-       <input type="hidden" name="id" value="${data.id}">
+       <input type="hidden" name="id" value="${encodeHTML(data.id)}">
        <if data.new><input type="hidden" name="do" value="insert">
        <else><input type="hidden" name="do" value="update"></if>
 <table border="0">
@@ -17,7 +17,7 @@ ${lang("message.htmltitle")}
     <td align="right" bgcolor="#006600"><font color="#ffffff" face="Verdana, Arial, Helvetica, sans-serif" size="-1">
        <B>${lang("message.date")}:</B></font></td>
     <td>
-      ${data.date}
+      ${encodeHTML(data.date)}
     </td>
   </tr>
 
@@ -25,7 +25,7 @@ ${lang("message.htmltitle")}
     <td align="right" bgcolor="#006600"><font color="#ffffff" face="Verdana, Arial, Helvetica, sans-serif" size="-1">
        <B>${lang("message.title")}:</B></td>
     <td>
-        <input type=text name="title" maxlength=40 value="${data.title}">
+        <input type=text name="title" maxlength=40 value="${encodeHTML(data.title)}">
     </td>
   </tr>
 
@@ -33,7 +33,7 @@ ${lang("message.htmltitle")}
     <td align="right" bgcolor="#006600"><font color="#ffffff" face="Verdana, Arial, Helvetica, sans-serif" size="-1">
        <B>${lang("message.creator")}:</B></td>
     <td>
-        <input type=text name="creator" maxlength=40 value="${data.creator}">
+        <input type=text name="creator" maxlength=40 value="${encodeHTML(data.creator)}">
     </td>
   </tr>
 
@@ -41,7 +41,7 @@ ${lang("message.htmltitle")}
     <td align="right" bgcolor="#006600"><font color="#ffffff" face="Verdana, Arial, Helvetica, sans-serif" size="-1">
        <B>${lang("message.text")}:</B> ${lang("message.textinfo")}</font></td>
     <td>
-        <textarea cols="50" rows="3" name="description" wrap=virtual>${data.description}</textarea>
+        <textarea cols="50" rows="3" name="description" wrap=virtual>${encodeHTML(data.description)}</textarea>
     </td>
   </tr>
 
The Mir CMS