wrap pretty much all freemarker variables (i.e the data) in encodeHTML(data..). this...

[mir.git] / templates-dist / admin / languagelist.template

diff --git a/templates-dist/admin/languagelist.template b/templates-dist/admin/languagelist.template
index c886025..2e884ba 100755 (executable)
--- a/templates-dist/admin/languagelist.template
+++ b/templates-dist/admin/languagelist.template
@@ -17,14 +17,14 @@
   <tr
        <if grey=="1"><assign grey="0">bgcolor="#dddddd" <else><assign grey="1"> </if>
   >
-  <td>${entry.name}&nbsp;</td>
-  <td>${entry.code}&nbsp;</td>
-  <td><font size="1">&nbsp;<a href="${config.actionRoot}?module=Language&do=delete&id=${entry.id}">${lang("delete")}</a>
-    | <a href="${config.actionRoot}?module=Language&do=edit&id=${entry.id}">${lang("edit")}</a></font></td>
+  <td>${encodeHTML(entry.name)}&nbsp;</td>
+  <td>${encodeHTML(entry.code)}&nbsp;</td>
+  <td><font size="1">&nbsp;<a href="${encodeHTML(config.actionRoot)}?module=Language&do=delete&id=${encodeHTML(entry.id)}">${lang("delete")}</a>
+    | <a href="${encodeHTML(config.actionRoot)}?module=Language&do=edit&id=${encodeHTML(entry.id)}">${lang("edit")}</a></font></td>
   </tr>
   </list>
   <tr>
-    <td colspan="3" bgcolor="#006600"><font color="#ffffff">${data.count} ${lang("records")}
+    <td colspan="3" bgcolor="#006600"><font color="#ffffff">${encodeHTML(data.count)} ${lang("records")}
       / ${lang("show_from_to", data.from, data.to)}</font></td>
     <td>&nbsp;</td>
   </tr>
@@ -32,10 +32,10 @@
 
       <P>
 <if data.prev>
-       <a href="${config.actionRoot}?module=Language&do=list&where=${data.where}&prevoffset=${data.prev}&prev=zur&uuml;ck">${lang("list.previous")}</a>&nbsp;
+       <a href="${encodeHTML(config.actionRoot)}?module=Language&do=list&where=${encodeHTML(data.where)}&prevoffset=${encodeHTML(data.prev)}&prev=zur&uuml;ck">${lang("list.previous")}</a>&nbsp;
 </if>
 <if data.next>
-<a href="${config.actionRoot}?module=Language&do=list&where=${data.where}&nextoffset=${data.next}&next=weiter">${lang("list.next")}</a>
+<a href="${encodeHTML(config.actionRoot)}?module=Language&do=list&where=${encodeHTML(data.where)}&nextoffset=${encodeHTML(data.next)}&next=weiter">${lang("list.next")}</a>
 </if>
 
 <else>