';
@@ -437,11 +423,9 @@ class ormCaseLog {
}
$iPos += $aIndex[$index]['separator_length'];
$sTextEntry = substr($this->m_sLog, $iPos, $aIndex[$index]['text_length']);
- if (!array_key_exists('format', $aIndex[$index]) || ($aIndex[$index]['format'] == static::ENUM_FORMAT_TEXT))
- {
- $sTextEntry = str_replace(array("\r\n", "\n", "\r"), "
", htmlentities($sTextEntry, ENT_QUOTES, 'UTF-8'));
- if (!is_null($aTransfoHandler))
- {
+ if (!array_key_exists('format', $aIndex[$index]) || ($aIndex[$index]['format'] == static::ENUM_FORMAT_TEXT)) {
+ $sTextEntry = str_replace(array("\r\n", "\n", "\r"), "
", utils::EscapeHtml($sTextEntry));
+ if (!is_null($aTransfoHandler)) {
$sTextEntry = call_user_func($aTransfoHandler, $sTextEntry);
}
}
@@ -483,19 +467,16 @@ class ormCaseLog {
$oBlock->AddSubBlock($oCollapsibleBlock);
}
// Process the case of an eventual remainder (quick migration of AttributeText fields)
- if ($iPos < (strlen($this->m_sLog) - 1))
- {
+ if ($iPos < (strlen($this->m_sLog) - 1)) {
// In this case the format is always "text"
$sTextEntry = substr($this->m_sLog, $iPos);
- $sTextEntry = str_replace(array("\r\n", "\n", "\r"), "
", htmlentities($sTextEntry, ENT_QUOTES, 'UTF-8'));
- if (!is_null($aTransfoHandler))
- {
+ $sTextEntry = str_replace(array("\r\n", "\n", "\r"), "
", utils::EscapeHtml($sTextEntry));
+ if (!is_null($aTransfoHandler)) {
$sTextEntry = call_user_func($aTransfoHandler, $sTextEntry);
}
- if (count($this->m_aIndex) == 0)
- {
- $oCollapsibleBlock = CollapsibleSectionUIBlockFactory::MakeStandard( '');
+ if (count($this->m_aIndex) == 0) {
+ $oCollapsibleBlock = CollapsibleSectionUIBlockFactory::MakeStandard('');
$oCollapsibleBlock->AddSubBlock(new Html($sTextEntry));
$oCollapsibleBlock->SetOpenedByDefault(true);
$oBlock->AddSubBlock($oCollapsibleBlock);
diff --git a/core/ormdocument.class.inc.php b/core/ormdocument.class.inc.php
index 1af6b5c67..badd01904 100644
--- a/core/ormdocument.class.inc.php
+++ b/core/ormdocument.class.inc.php
@@ -109,17 +109,14 @@ class ormDocument
public function GetAsHTML()
{
$sResult = '';
- if ($this->IsEmpty())
- {
+ if ($this->IsEmpty()) {
// If the filename is not empty, display it, this is used
// by the creation wizard while the file has not yet been uploaded
- $sResult = htmlentities($this->GetFileName(), ENT_QUOTES, 'UTF-8');
- }
- else
- {
+ $sResult = utils::EscapeHtml($this->GetFileName());
+ } else {
$data = $this->GetData();
$sSize = utils::BytesToFriendlyFormat(strlen($data));
- $sResult = htmlentities($this->GetFileName(), ENT_QUOTES, 'UTF-8').' ('.$sSize.')
';
+ $sResult = utils::EscapeHtml($this->GetFileName()).' ('.$sSize.')
';
}
return $sResult;
}
@@ -131,7 +128,8 @@ class ormDocument
public function GetDisplayLink($sClass, $Id, $sAttCode)
{
$sUrl = $this->GetDisplayURL($sClass, $Id, $sAttCode);
- return "
".htmlentities($this->GetFileName(), ENT_QUOTES, 'UTF-8')." \n";
+
+ return "
".utils::EscapeHtml($this->GetFileName())." \n";
}
/**
@@ -141,7 +139,8 @@ class ormDocument
public function GetDownloadLink($sClass, $Id, $sAttCode)
{
$sUrl = $this->GetDownloadURL($sClass, $Id, $sAttCode);
- return "
".htmlentities($this->GetFileName(), ENT_QUOTES, 'UTF-8')." \n";
+
+ return "
".utils::EscapeHtml($this->GetFileName())." \n";
}
/**
diff --git a/core/pdfbulkexport.class.inc.php b/core/pdfbulkexport.class.inc.php
index ba25a61ed..df22d7141 100644
--- a/core/pdfbulkexport.class.inc.php
+++ b/core/pdfbulkexport.class.inc.php
@@ -62,7 +62,7 @@ class PDFBulkExport extends HTMLBulkExport
$aPossibleFormat = ['A3', 'A4', 'Letter'];
$sDefaultFormat = 'A4';
foreach ($aPossibleFormat as $sVal) {
- $oSelectFormat->AddSubBlock(SelectOptionUIBlockFactory::MakeForSelectOption($sVal, htmlentities(Dict::S('Core:BulkExport:PageSize-'.$sVal), ENT_QUOTES, 'UTF-8'), ($sVal == $sDefaultFormat)));
+ $oSelectFormat->AddSubBlock(SelectOptionUIBlockFactory::MakeForSelectOption($sVal, utils::EscapeHtml(Dict::S('Core:BulkExport:PageSize-'.$sVal)), ($sVal == $sDefaultFormat)));
}
$oFieldSetFormat->AddSubBlock(new Html(''));
@@ -75,7 +75,7 @@ class PDFBulkExport extends HTMLBulkExport
$aPossibleOrientation = ['P', 'L'];
$sDefaultOrientation = 'L';
foreach ($aPossibleOrientation as $sVal) {
- $oSelectOrientation->AddSubBlock(SelectOptionUIBlockFactory::MakeForSelectOption($sVal, htmlentities(Dict::S('Core:BulkExport:PageOrientation-'.$sVal), ENT_QUOTES, 'UTF-8'), ($sVal == $sDefaultOrientation)));
+ $oSelectOrientation->AddSubBlock(SelectOptionUIBlockFactory::MakeForSelectOption($sVal, utils::EscapeHtml(Dict::S('Core:BulkExport:PageOrientation-'.$sVal)), ($sVal == $sDefaultOrientation)));
}
//date format
@@ -84,8 +84,8 @@ class PDFBulkExport extends HTMLBulkExport
$sDateTimeFormat = utils::ReadParam('date_format', (string)AttributeDateTime::GetFormat(), true, 'raw_data');
- $sDefaultFormat = htmlentities((string)AttributeDateTime::GetFormat(), ENT_QUOTES, 'UTF-8');
- $sExample = htmlentities(date((string)AttributeDateTime::GetFormat()), ENT_QUOTES, 'UTF-8');
+ $sDefaultFormat = utils::EscapeHtml((string)AttributeDateTime::GetFormat());
+ $sExample = utils::EscapeHtml(date((string)AttributeDateTime::GetFormat()));
$oRadioDefault = InputUIBlockFactory::MakeForInputWithLabel(Dict::Format('Core:BulkExport:DateTimeFormatDefault_Example', $sDefaultFormat, $sExample), "pdf_date_format_radio", "default", "pdf_date_time_format_default", "radio");
$oRadioDefault->GetInput()->SetIsChecked(($sDateTimeFormat == (string)AttributeDateTime::GetFormat()));
$oRadioDefault->SetBeforeInput(false);
@@ -93,7 +93,7 @@ class PDFBulkExport extends HTMLBulkExport
$oFieldSetDate->AddSubBlock($oRadioDefault);
$oFieldSetDate->AddSubBlock(new Html(''));
- $sFormatInput = '
';
+ $sFormatInput = '
';
$oRadioCustom = InputUIBlockFactory::MakeForInputWithLabel(Dict::Format('Core:BulkExport:DateTimeFormatCustom_Format', $sFormatInput), "pdf_date_format_radio", "custom", "pdf_date_time_format_custom", "radio");
$oRadioCustom->SetDescription(Dict::S('UI:CSVImport:CustomDateTimeFormatTooltip'));
$oRadioCustom->GetInput()->SetIsChecked($sDateTimeFormat !== (string)AttributeDateTime::GetFormat());
diff --git a/core/spreadsheetbulkexport.class.inc.php b/core/spreadsheetbulkexport.class.inc.php
index 50629d400..6bd557dc8 100644
--- a/core/spreadsheetbulkexport.class.inc.php
+++ b/core/spreadsheetbulkexport.class.inc.php
@@ -73,8 +73,8 @@ class SpreadsheetBulkExport extends TabularBulkExport
$sDateTimeFormat = utils::ReadParam('date_format', (string)AttributeDateTime::GetFormat(), true, 'raw_data');
- $sDefaultFormat = htmlentities((string)AttributeDateTime::GetFormat(), ENT_QUOTES, 'UTF-8');
- $sExample = htmlentities(date((string)AttributeDateTime::GetFormat()), ENT_QUOTES, 'UTF-8');
+ $sDefaultFormat = utils::EscapeHtml((string)AttributeDateTime::GetFormat());
+ $sExample = utils::EscapeHtml(date((string)AttributeDateTime::GetFormat()));
$oRadioDefault = InputUIBlockFactory::MakeForInputWithLabel(Dict::Format('Core:BulkExport:DateTimeFormatDefault_Example', $sDefaultFormat, $sExample), "spreadsheet_date_format_radio", "default", "spreadsheet_date_time_format_default", "radio");
$oRadioDefault->GetInput()->SetIsChecked(($sDateTimeFormat == (string)AttributeDateTime::GetFormat()));
$oRadioDefault->GetInput()->AddCSSClass('ibo-input-checkbox');
@@ -82,7 +82,7 @@ class SpreadsheetBulkExport extends TabularBulkExport
$oFieldSetDate->AddSubBlock($oRadioDefault);
$oFieldSetDate->AddSubBlock(new Html(''));
- $sFormatInput = '
';
+ $sFormatInput = '
';
$oRadioCustom = InputUIBlockFactory::MakeForInputWithLabel(Dict::Format('Core:BulkExport:DateTimeFormatCustom_Format', $sFormatInput), "spreadsheet_date_format_radio", "custom", "spreadsheet_date_time_format_custom", "radio");
$oRadioCustom->SetDescription(Dict::S('UI:CSVImport:CustomDateTimeFormatTooltip'));
$oRadioCustom->GetInput()->SetIsChecked($sDateTimeFormat !== (string)AttributeDateTime::GetFormat());
@@ -140,7 +140,8 @@ EOF
if ($oAttDef instanceof AttributeDateTime) // AttributeDate is derived from AttributeDateTime
{
$sClass = (get_class($oAttDef) == 'AttributeDateTime') ? 'user-formatted-date-time' : 'user-formatted-date';
- return '
'.htmlentities($oAttDef->GetEditValue($oObj->Get($sAttCode), $oObj), ENT_QUOTES, 'UTF-8').'
';
+
+ return '
'.utils::EscapeHtml($oAttDef->GetEditValue($oObj->Get($sAttCode), $oObj)).'
';
}
}
return $this->GetValue($oObj, $sAttCode);
@@ -158,19 +159,13 @@ EOF
default:
$value = $oObj->Get($sAttCode);
$oAttDef = MetaModel::GetAttributeDef(get_class($oObj), $sAttCode);
- if ($value instanceof ormCaseLog)
- {
- $sRet = str_replace("\n", "
", htmlentities($value->__toString(), ENT_QUOTES, 'UTF-8'));
- }
- elseif ($value instanceof ormStopWatch)
- {
+ if ($value instanceof ormCaseLog) {
+ $sRet = str_replace("\n", "
", utils::EscapeHtml($value->__toString()));
+ } elseif ($value instanceof ormStopWatch) {
$sRet = $value->GetTimeSpent();
- }
- elseif ($value instanceof ormDocument)
- {
+ } elseif ($value instanceof ormDocument) {
$sRet = '';
- }
- elseif ($oAttDef instanceof AttributeText)
+ } elseif ($oAttDef instanceof AttributeText)
{
if ($bFormattedText)
{
@@ -191,15 +186,11 @@ EOF
// Stick to the weird implementation made in GetNextChunk
$sRet = utils::TextToHtml($oObj->GetEditValue($sAttCode));
}
- else
- {
- if ($this->bLocalizeOutput)
- {
- $sRet = htmlentities($oObj->GetEditValue(), ENT_QUOTES, 'UTF-8');
- }
- else
- {
- $sRet = htmlentities((string)$value, ENT_QUOTES, 'UTF-8');
+ else {
+ if ($this->bLocalizeOutput) {
+ $sRet = utils::EscapeHtml($oObj->GetEditValue());
+ } else {
+ $sRet = utils::EscapeHtml((string)$value);
}
}
}
@@ -314,22 +305,16 @@ EOF
$sData .= "
$sDate ";
$sData .= "
$sTime ";
}
- else if (get_class($oFinalAttDef) == 'AttributeDate')
- {
+ else if (get_class($oFinalAttDef) == 'AttributeDate') {
$sDate = $oDateFormat->Format($oObj->Get($sAttCode));
$sData .= "
$sDate ";
- }
- else if($oAttDef instanceof AttributeCaseLog)
- {
+ } else if ($oAttDef instanceof AttributeCaseLog) {
$rawValue = $oObj->Get($sAttCode);
- $sField = str_replace("\n", "
", htmlentities($rawValue->__toString(), ENT_QUOTES, 'UTF-8'));
+ $sField = str_replace("\n", "
", utils::EscapeHtml($rawValue->__toString()));
// Trick for Excel: treat the content as text even if it begins with an equal sign
$sData .= "
$sField ";
- }
- elseif ($oAttDef instanceof AttributeText)
- {
- if ($bFormattedText)
- {
+ } elseif ($oAttDef instanceof AttributeText) {
+ if ($bFormattedText) {
// Replace paragraphs (
..., etc) by line breaks ($sField ";
}
- else
- {
+ else {
$rawValue = $oObj->Get($sAttCode);
- if ($this->bLocalizeOutput)
- {
- $sField = htmlentities($oFinalAttDef->GetEditValue($rawValue), ENT_QUOTES, 'UTF-8');
- }
- else
- {
- $sField = htmlentities($rawValue, ENT_QUOTES, 'UTF-8');
+ if ($this->bLocalizeOutput) {
+ $sField = utils::EscapeHtml($oFinalAttDef->GetEditValue($rawValue));
+ } else {
+ $sField = utils::EscapeHtml($rawValue);
}
$sData .= "$sField ";
}
diff --git a/core/userrights.class.inc.php b/core/userrights.class.inc.php
index 4567bc8ac..adfa4cb18 100644
--- a/core/userrights.class.inc.php
+++ b/core/userrights.class.inc.php
@@ -527,7 +527,7 @@ abstract class User extends cmdbAbstractObject
{
if (UserRights::IsStimulusAllowed($sClass, $sStimulusCode, null, $this))
{
- $aStimuli[] = ''.htmlentities($oStimulus->GetLabel(), ENT_QUOTES, 'UTF-8').' ';
+ $aStimuli[] = ''.utils::EscapeHtml($oStimulus->GetLabel()).' ';
}
}
$sStimuli = implode(', ', $aStimuli);
diff --git a/datamodels/2.x/itop-attachments/ajax.itop-attachment.php b/datamodels/2.x/itop-attachments/ajax.itop-attachment.php
index f5f45997c..cdf5d1aef 100644
--- a/datamodels/2.x/itop-attachments/ajax.itop-attachment.php
+++ b/datamodels/2.x/itop-attachments/ajax.itop-attachment.php
@@ -104,7 +104,7 @@ try
$oAttachment->Set('contents', $oDoc);
$iAttId = $oAttachment->DBInsert();
- $aResult['msg'] = htmlentities($oDoc->GetFileName(), ENT_QUOTES, 'UTF-8');
+ $aResult['msg'] = utils::EscapeHtml($oDoc->GetFileName());
$aResult['icon'] = utils::GetAbsoluteUrlAppRoot().AttachmentPlugIn::GetFileIcon($oDoc->GetFileName());
$aResult['att_id'] = $iAttId;
$aResult['preview'] = $oDoc->IsPreviewAvailable() ? 'true' : 'false';
@@ -138,9 +138,8 @@ try
$oPage->output();
}
-catch (Exception $e)
-{
+catch (Exception $e) {
// note: transform to cope with XSS attacks
- echo htmlentities($e->GetMessage(), ENT_QUOTES, 'utf-8');
+ echo utils::EscapeHtml($e->GetMessage());
IssueLog::Error($e->getMessage());
}
diff --git a/datamodels/2.x/itop-attachments/main.itop-attachments.php b/datamodels/2.x/itop-attachments/main.itop-attachments.php
index 24ad38a6e..dad027bf6 100644
--- a/datamodels/2.x/itop-attachments/main.itop-attachments.php
+++ b/datamodels/2.x/itop-attachments/main.itop-attachments.php
@@ -679,13 +679,12 @@ class CMDBChangeOpAttachmentAdded extends CMDBChangeOp
// Temporary, until we change the options of GetDescription() -needs a more global revision
$sTargetObjectClass = 'Attachment';
$iTargetObjectKey = $this->Get('attachment_id');
- $sFilename = htmlentities($this->Get('filename'), ENT_QUOTES, 'UTF-8');
+ $sFilename = utils::EscapeHtml($this->Get('filename'));
$oTargetSearch = new DBObjectSearch($sTargetObjectClass);
$oTargetSearch->AddCondition('id', $iTargetObjectKey, '=');
$oMonoObjectSet = new DBObjectSet($oTargetSearch);
- if ($oMonoObjectSet->Count() > 0)
- {
+ if ($oMonoObjectSet->Count() > 0) {
$oAttachment = $oMonoObjectSet->Fetch();
$oDoc = $oAttachment->Get('contents');
$sPreview = $oDoc->IsPreviewAvailable() ? 'data-preview="true"' : '';
@@ -739,7 +738,7 @@ class CMDBChangeOpAttachmentRemoved extends CMDBChangeOp
{
// Temporary, until we change the options of GetDescription() -needs a more global revision
$sResult = Dict::Format('Attachments:History_File_Removed',
- ''.htmlentities($this->Get('filename'), ENT_QUOTES, 'UTF-8').' ');
+ ''.utils::EscapeHtml($this->Get('filename')).' ');
return $sResult;
}
diff --git a/datamodels/2.x/itop-config/config.php b/datamodels/2.x/itop-config/config.php
index eca3dba63..3db15541b 100644
--- a/datamodels/2.x/itop-config/config.php
+++ b/datamodels/2.x/itop-config/config.php
@@ -170,7 +170,8 @@ try {
$iEditorTopMargin += 5*$iWarnings;
$sOriginalConfig = str_replace("\r\n", "\n", file_get_contents($sConfigFile));
- } catch (Exception $e) {
+ }
+ catch (Exception $e) {
$oAlert = AlertUIBlockFactory::MakeForDanger('', $e->getMessage());
$iEditorTopMargin += 5;
$oP->AddUiBlock($oAlert);
@@ -180,8 +181,8 @@ try {
}
- $sConfigEscaped = htmlentities($sConfig, ENT_QUOTES, 'UTF-8');
- $sOriginalConfigEscaped = htmlentities($sOriginalConfig, ENT_QUOTES, 'UTF-8');
+ $sConfigEscaped = utils::EscapeHtml($sConfig);
+ $sOriginalConfigEscaped = utils::EscapeHtml($sOriginalConfig);
$oP->AddUiBlock(new Html(''.Dict::S('config-edit-intro').'
'));
$oForm = new Form();
diff --git a/datamodels/2.x/itop-hub-connector/land.php b/datamodels/2.x/itop-hub-connector/land.php
index ed4a32264..8129422fd 100644
--- a/datamodels/2.x/itop-hub-connector/land.php
+++ b/datamodels/2.x/itop-hub-connector/land.php
@@ -36,11 +36,11 @@ function DisplayStatus(WebPage $oPage)
$sCode = $oExtension->sCode;
$sDir = basename($oExtension->sSourceDir);
$oPage->add(''.htmlentities($oExtension->sLabel, ENT_QUOTES, 'UTF-8').' '.$sInstallation.''.utils::EscapeHtml($oExtension->sLabel).' '.$sInstallation.'');
$oPage->add('
');
if ($oExtension->sDescription != '') {
- $oPage->add(htmlentities($oExtension->sDescription, ENT_QUOTES, 'UTF-8').'');
+ $oPage->add(utils::EscapeHtml($oExtension->sDescription).'');
}
$oPage->add('
');
$oPage->add('
');
$oPage->add('
');
$sTitle = Dict::Format('iTopHub:InstallationEffect:MissingDependencies_Details', implode(', ', $oExtension->aMissingDependencies));
- $oPage->add('
'.htmlentities($oExtension->sLabel, ENT_QUOTES, 'UTF-8').' '.Dict::S('iTopHub:InstallationEffect:MissingDependencies').' ');
+ $oPage->add('
'.utils::EscapeHtml($oExtension->sLabel).' '.Dict::S('iTopHub:InstallationEffect:MissingDependencies').' ');
$oPage->add('
');
$oPage->add('
');
if ($oExtension->sDescription != '') {
- $oPage->add(htmlentities($oExtension->sDescription, ENT_QUOTES, 'UTF-8').'');
+ $oPage->add(utils::EscapeHtml($oExtension->sDescription).'');
}
$oPage->add('
');
$oPage->add('
');
@@ -189,11 +189,11 @@ function DoInstall(WebPage $oPage)
$sCode = $oExtension->sCode;
$sDir = basename($oExtension->sSourceDir);
$oPage->add('
');
- $oPage->add('
'.htmlentities($oExtension->sLabel, ENT_QUOTES, 'UTF-8').' '.$sInstallation.'');
+ $oPage->add('
'.utils::EscapeHtml($oExtension->sLabel).' '.$sInstallation.'');
$oPage->add('
');
$oPage->add('
');
if ($oExtension->sDescription != '') {
- $oPage->add(htmlentities($oExtension->sDescription, ENT_QUOTES, 'UTF-8').'');
+ $oPage->add(utils::EscapeHtml($oExtension->sDescription).'');
}
$oPage->add('
');
$oPage->add('
');
diff --git a/datamodels/2.x/itop-hub-connector/launch.php b/datamodels/2.x/itop-hub-connector/launch.php
index e7fb355fe..629a7f0dd 100644
--- a/datamodels/2.x/itop-hub-connector/launch.php
+++ b/datamodels/2.x/itop-hub-connector/launch.php
@@ -282,7 +282,7 @@ try {
$oPage = new NiceWebPage('');
$aDataToPost = MakeDataToPost($sTargetRoute);
$oPage->add('
';
- foreach ($checks['databases'] as $sDatabaseName)
- {
- if ($sDatabaseName != 'information_schema')
- {
- $sEncodedName = htmlentities($sDatabaseName, ENT_QUOTES, 'UTF-8');
+ foreach ($checks['databases'] as $sDatabaseName) {
+ if ($sDatabaseName != 'information_schema') {
+ $sEncodedName = utils::EscapeHtml($sDatabaseName);
$sSelected = ($sDatabaseName == $sDBName) ? ' selected ' : '';
$sDBNameInput .= ''.$sEncodedName.' ';
}
@@ -1541,8 +1530,7 @@ JS
$aLanguages = SetupUtils::GetAvailableLanguages($sSourceDir);
foreach ($aLanguages as $sCode => $aInfo) {
$sSelected = ($sCode == $sDefaultLanguageCode) ? 'selected ' : '';
- $sHtml .= ''.htmlentities($aInfo['description'], ENT_QUOTES,
- 'UTF-8').' ('.htmlentities($aInfo['localized_description'], ENT_QUOTES, 'UTF-8').') ';
+ $sHtml .= ''.utils::EscapeHtml($aInfo['description']).' ('.utils::EscapeHtml($aInfo['localized_description']).') ';
}
$sHtml .= '