diff --git a/application/dashboard.class.inc.php b/application/dashboard.class.inc.php index 462399943..61f3baeb4 100644 --- a/application/dashboard.class.inc.php +++ b/application/dashboard.class.inc.php @@ -842,7 +842,7 @@ class RuntimeDashboard extends Dashboard if (!$bEditMode && !$oPage->IsPrintableVersion()) { $sId = $this->GetId(); - $sDivId = preg_replace('/[^a-zA-Z0-9_]/', '', $sId); + $sDivId = utils::Sanitize($sId, '', 'element_identifier'); if ($this->GetAutoReload()) { $sFile = addslashes($this->GetDefinitionFile()); @@ -905,7 +905,7 @@ EOF protected function RenderSelector($oPage, $aAjaxParams = array()) { $sId = $this->GetId(); - $sDivId = preg_replace('/[^a-zA-Z0-9_]/', '', $sId); + $sDivId = utils::Sanitize($sId, '', 'element_identifier'); $sExtraParams = json_encode($aAjaxParams); $sSelectorHtml = '
'; diff --git a/application/menunode.class.inc.php b/application/menunode.class.inc.php index 3babcf41f..ce0637635 100644 --- a/application/menunode.class.inc.php +++ b/application/menunode.class.inc.php @@ -1190,7 +1190,7 @@ class DashboardMenuNode extends MenuNode $oDashboard = $this->GetDashboard(); if ($oDashboard != null) { - $sDivId = preg_replace('/[^a-zA-Z0-9_]/', '', $this->sMenuId); + $sDivId = utils::Sanitize($this->sMenuId, '', 'element_identifier'); $oPage->add('
'); $aExtraParams['dashboard_div_id'] = $sDivId; $oDashboard->SetReloadURL($this->GetHyperlink($aExtraParams)); diff --git a/application/utils.inc.php b/application/utils.inc.php index 23da0f53f..bcdb4483c 100644 --- a/application/utils.inc.php +++ b/application/utils.inc.php @@ -275,13 +275,14 @@ class utils /** * @param string|string[] $value * @param string $sSanitizationFilter one of : integer, class, string, context_param, parameter, field_name, - * transaction_id, parameter, raw_data + * element_identifier, transaction_id, parameter, raw_data * * @return string|string[]|bool boolean for : * * the 'class' filter (true if valid, false otherwise) * * if the filter fails (@see \filter_var()) * * @since 2.5.2 2.6.0 new 'transaction_id' filter + * @since 2.7.0 new 'element_identifier' filter */ protected static function Sanitize_Internal($value, $sSanitizationFilter) { @@ -351,6 +352,11 @@ class utils } break; + // For XML / HTML node identifiers + case 'element_identifier': + $retValue = preg_replace('/[^a-zA-Z0-9_]/', '', $value); + break; + default: case 'raw_data': $retValue = $value; diff --git a/pages/ajax.render.php b/pages/ajax.render.php index 7d1424d72..403d9fb74 100644 --- a/pages/ajax.render.php +++ b/pages/ajax.render.php @@ -1139,7 +1139,7 @@ try $oDashboard->FromParams($aParams); $oDashboard->Save(); $sDashboardFile = addslashes(utils::ReadParam('file', '', false, 'raw_data')); - $sDivId = preg_replace('/[^a-zA-Z0-9_]/', '', $sDashboardId); + $sDivId = utils::Sanitize($sDashboardId, '', 'element_identifier'); // trigger a reload of the current page since the dashboard just changed $oPage->add_script( <<Revert(); $sFile = addslashes($oDashboard->GetDefinitionFile()); - $sDivId = preg_replace('/[^a-zA-Z0-9_]/', '', $sDashboardId); + $sDivId = utils::Sanitize($sDashboardId, '', 'element_identifier'); // trigger a reload of the current page since the dashboard just changed $oPage->add_script( <<