php/LuckyCoinkydink
Archived
1
0
Fork 0
Code Issues Pull Requests Activity

upport 1.7.6 security fixes

Browse Source
This commit is contained in:
Garvin Hicking
2014-02-06 09:36:31 +01:00
parent 7fe805cd48
commit 3d7765f066
8 changed files with 55 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
templates/2k11/admin/entries.tpl
+3 -3
View File
@@ -6,8 +6,8 @@
{foreach $entry_vars.hiddens as $key => $value}
<input type="hidden" name="{$key}" value="{$value}">
{/foreach}
<input type="hidden" id="entryid" name="serendipity[id]" value="{$entry_vars.entry.id}">
<input type="hidden" name="serendipity[timestamp]" value="{$entry_vars.timestamp}">
<input type="hidden" id="entryid" name="serendipity[id]" value="{$entry_vars.entry.id|escape:'html'}">
<input type="hidden" name="serendipity[timestamp]" value="{$entry_vars.timestamp|escape:'html'}">
<input type="hidden" name="serendipity[preview]" value="false">
{$entry_vars.formToken}
<div id="edit_entry_title" class="form_field">
@@ -66,7 +66,7 @@
<div id="meta_data" class="additional_info">
{if $entry_vars.allowDateManipulation}
<div id="edit_entry_timestamp" class="form_field">
<input name="serendipity[chk_timestamp]" type="hidden" value="{$entry_vars.timestamp}">
<input name="serendipity[chk_timestamp]" type="hidden" value="{$entry_vars.timestamp|escape:'html'}">
<label for="serendipityNewTimestamp">{$CONST.DATE}</label>
<input id="serendipityNewTimestamp" name="serendipity[new_timestamp]" type="datetime-local" value="{$entry_vars.timestamp|@formatTime:'o-m-d\TH:i':true:false:true}">
templates/2k11/admin/users.inc.tpl
+2 -2
View File
@@ -44,10 +44,10 @@
{foreach $users as $user}
{if $user.isEditable}
<li class="clearfix {cycle values="odd,even"}">
<span class="user_name"><span class="icon-user"></span> {$user.realname|escape:"html"} <span class="user_level">({$user.userlevel_name})</span></span>
<span class="user_name"><span class="icon-user"></span> {$user.realname|escape:"html"} <span class="user_level">({$user.userlevel_name|escape:'html'})</span></span>
<ul class="plainList clearfix edit_actions">
<li><a class="button_link" href="{$user.authorUrl}" title="{$CONST.ENTRIES_FOR|sprintf:{$user.realname}}"><span class="icon-zoom-in"></span><span class="visuallyhidden"> {$CONST.ENTRIES_FOR|sprintf:{$user.realname}}</span></a></li>
<li><a class="button_link" href="{$user.authorUrl}" title="{$CONST.ENTRIES_FOR|sprintf:{$user.realname|escape:'html'}}"><span class="icon-zoom-in"></span><span class="visuallyhidden"> {$CONST.ENTRIES_FOR|sprintf:{$user.realname}|escape:'html'}</span></a></li>
<li><a class="button_link" href="?serendipity[adminModule]=users&amp;serendipity[adminAction]=edit&amp;serendipity[userid]={$user.authorid}#editform" title="{$CONST.EDIT} {$user.realname|escape:"html"}"><span class="icon-edit"></span><span class="visuallyhidden"> {$CONST.EDIT}</span></a></li>
<li><a class="button_link" href="?{$urlFormToken}&amp;serendipity[adminModule]=users&amp;serendipity[adminAction]=delete&amp;serendipity[userid]=$user.authorid" title="{$CONST.DELETE} {$user.realname|escape:"html"}"><span class="icon-trash"></span><span class="visuallyhidden"> {$CONST.DELETE}</span></a></li>
</ul>