Skip to content

Commit 0e6d92e

Browse files
jissereitsmajissereitsma
committed
Add escaping
1 parent 609a911 commit 0e6d92e

35 files changed

Lines changed: 155 additions & 119 deletions

‎view/adminhtml/templates/form.phtml‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,20 +17,24 @@ if (!isset($viewModel)) {
1717
}
1818
?>
1919
<div class="loki-form form">
20-
<?= $blockRenderer->html($block, 'loki-admin.form.actions', ['view_model' => $viewModel]) ?>
20+
<?= /* @noEscape */
21+
$blockRenderer->html($block, 'loki-admin.form.actions', ['view_model' => $viewModel]) ?>
2122

2223
<div class="page-columns">
2324
<div class="main-col">
24-
<?= $blockRenderer->html($block, 'loki-admin.form.spinner') ?>
25-
<?= $blockRenderer->html($block, 'loki-admin.form.inner') ?>
25+
<?= /* @noEscape */
26+
$blockRenderer->html($block, 'loki-admin.form.spinner') ?>
27+
<?= /* @noEscape */
28+
$blockRenderer->html($block, 'loki-admin.form.inner') ?>
2629

2730
<div class="entry-edit form-inline">
2831
<div class="fieldset-wrapper">
29-
<h1><?= $block->getLabel() ?></h1>
32+
<h1><?= $escaper->escapeHtml($block->getLabel()) ?></h1>
3033
<div class="admin__fieldset-wrapper-content">
3134
<fieldset class="admin__fieldset">
3235
<?php foreach ($viewModel->getFields() as $field) : ?>
33-
<?= $templateRenderer->html(
36+
<?= /* @noEscape */
37+
$templateRenderer->html(
3438
$block,
3539
'Loki_AdminComponents::form/field.phtml',
3640
['field' => $field]

‎view/adminhtml/templates/form/actions.phtml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -26,11 +26,11 @@ $otherSaveActions = [];
2626
<?php foreach ($buttons as $button) : ?>
2727
<?php $subButtons = $button->getSubButtons(); ?>
2828
<button
29-
@click="<?= $button->getMethod() ?>"
30-
title="<?= __($button->getLabel()) ?>"
29+
@click="<?= $escaper->escapeHtml($button->getMethod()) ?>"
30+
title="<?= $escaper->escapeHtml(__($button->getLabel())) ?>"
3131
type="button"
32-
class="action- scalable <?= $button->getCssClass() ?>">
33-
<span><?= __($button->getLabel()) ?></span>
32+
class="action- scalable <?= $escaper->escapeHtml($button->getCssClass()) ?>">
33+
<span><?= $escaper->escapeHtml(__($button->getLabel())) ?></span>
3434
</button>
3535
<?php endforeach; ?>
3636

‎view/adminhtml/templates/form/field.phtml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,13 +20,14 @@ if (false === $field instanceof Field) {
2020
?>
2121
<div class="admin__field">
2222
<div class="admin__field-label">
23-
<label for="<?= $field->getCode() ?>">
24-
<span><?= $field->getLabel() ?></span>
23+
<label for="<?= $escaper->escapeHtml($field->getCode()) ?>">
24+
<span><?= $escaper->escapeHtml($field->getLabel()) ?></span>
2525
</label>
2626
</div>
2727

2828
<div class="admin__field-control">
29-
<?= $templateRenderer->html(
29+
<?= /* @noEscape */
30+
$templateRenderer->html(
3031
$block,
3132
$field->getFieldType()->getTemplate(),
3233
['field' => $field]

‎view/adminhtml/templates/form/field_type/from_to.phtml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -22,11 +22,11 @@ $fieldType = $field->getFieldType();
2222
<input
2323
class="admin__control-text"
2424
type="text"
25-
data-name="<?= $field->getCode() ?>"
26-
maxlength="<?= $fieldType->getMaximumLength() ?>"
27-
:value="<?= $field->getScope() ?>.<?= $field->getCode() ?>"
25+
data-name="<?= $escaper->escapeHtml($field->getCode()) ?>"
26+
maxlength="<?= $escaper->escapeHtml($fieldType->getMaximumLength()) ?>"
27+
:value="<?= $escaper->escapeHtml($field->getScope()) ?>.<?= $escaper->escapeHtml($field->getCode()) ?>"
2828
@change="setValue"
29-
placeholder="<?= $field->getBlock()->getPlaceholder() ?>"
29+
placeholder="<?= $escaper->escapeHtml($field->getBlock()->getPlaceholder()) ?>"
3030
>
3131
</div>
3232
</div>
@@ -38,11 +38,11 @@ $fieldType = $field->getFieldType();
3838
<input
3939
class="admin__control-text"
4040
type="text"
41-
data-name="<?= $field->getCode() ?>"
42-
maxlength="<?= $fieldType->getMaximumLength() ?>"
43-
:value="<?= $field->getScope() ?>.<?= $field->getCode() ?>"
41+
data-name="<?= $escaper->escapeHtml($field->getCode()) ?>"
42+
maxlength="<?= $escaper->escapeHtml($fieldType->getMaximumLength()) ?>"
43+
:value="<?= $escaper->escapeHtml($field->getScope()) ?>.<?= $escaper->escapeHtml($field->getCode()) ?>"
4444
@change="setValue"
45-
placeholder="<?= $field->getBlock()->getPlaceholder() ?>"
45+
placeholder="<?= $escaper->escapeHtml($field->getBlock()->getPlaceholder()) ?>"
4646
>
4747
</div>
4848
</div>

‎view/adminhtml/templates/form/field_type/select.phtml‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -20,17 +20,18 @@ $emptyOption = $parentBlock->getEmptyOption();
2020
$fieldType = $field->getFieldType();
2121
?>
2222
<select
23-
aria-label="<?= $field->getLabel() ?>"
23+
aria-label="<?= $escaper->escapeHtml($field->getLabel()) ?>"
2424
class="admin__control-select"
25-
name="<?= $field->getCode() ?>"
26-
data-name="<?= $field->getCode() ?>"
25+
name="<?= $escaper->escapeHtml($field->getCode()) ?>"
26+
data-name="<?= $escaper->escapeHtml($field->getCode()) ?>"
2727
<?php if ($parentBlock->getMultiple()) : ?>multiple<?php endif; ?>
28-
<?php if ($parentBlock->getSize()) : ?>size="<?= $parentBlock->getSize() ?>"<?php endif; ?>
29-
:value="<?= $field->getScope() ?>.<?= $field->getCode() ?>"
28+
<?php if ($parentBlock->getSize()) : ?>size="<?= $escaper->escapeHtml($parentBlock->getSize()) ?>"<?php endif; ?>
29+
:value="<?= $escaper->escapeHtml($field->getScope()) ?>.<?= $escaper->escapeHtml($field->getCode()) ?>"
3030
@change="setValue"
3131
>
3232
<?php if (!empty($emptyOption)): ?>
33-
<?= $templateRenderer->html(
33+
<?= /* @noEscape */
34+
$templateRenderer->html(
3435
$block,
3536
'Loki_AdminComponents::form/field_type/select/option.phtml',
3637
[
@@ -44,7 +45,8 @@ $fieldType = $field->getFieldType();
4445
<?php endif; ?>
4546
<?php foreach ($options->toOptionArray() as $option) : ?>
4647
<?= $option['level'] = 0; ?>
47-
<?= $templateRenderer->html(
48+
<?= /* @noEscape */
49+
$templateRenderer->html(
4850
$block,
4951
'Loki_AdminComponents::form/field_type/select/option.phtml',
5052
['option' => $option]

‎view/adminhtml/templates/form/field_type/select/option.phtml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,18 +11,19 @@ use Loki\Components\Util\Block\TemplateRenderer;
1111
$option = $block->getOption();
1212
?>
1313
<?php if (is_array($option['value'])): ?>
14-
<optgroup label="<?= str_repeat('&nbsp;', $option['level']) ?><?= $option['label'] ?>"></optgroup>
14+
<optgroup label="<?= $escaper->escapeHtml(str_repeat('&nbsp;', $option['level'])) ?><?= $option['label'] ?>"></optgroup>
1515
<?php foreach ($option['value'] as $suboption): ?>
1616
<?= $suboption['level'] = $option['level'] + 1; ?>
17-
<?= $templateRenderer->html(
17+
<?= /* @noEscape */
18+
$templateRenderer->html(
1819
$block,
1920
'Loki_AdminComponents::form/field_type/select/option.phtml',
2021
['option' => $suboption]
2122
) ?>
2223
<?php endforeach; ?>
2324
<?php else: ?>
2425
<option value="<?= $option['value'] ?>">
25-
<?= str_repeat('&nbsp;', $option['level']) ?>
26+
<?= $escaper->escapeHtml(str_repeat('&nbsp;', $option['level'])) ?>
2627
<?= $option['label'] ?>
2728
</option>
2829
<?php endif; ?>

‎view/adminhtml/templates/form/field_type/switch.phtml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -21,18 +21,18 @@ $fieldType = $field->getFieldType();
2121
<div class="admin__actions-switch">
2222
<input
2323
type="checkbox"
24-
name="<?= $field->getCode() ?>"
24+
name="<?= $escaper->escapeHtml($field->getCode()) ?>"
2525
class="admin__actions-switch-checkbox"
26-
:checked="<?= $field->getScope() ?>.<?= $field->getCode() ?>"
26+
:checked="<?= $escaper->escapeHtml($field->getScope()) ?>.<?= $escaper->escapeHtml($field->getCode()) ?>"
2727
@change="setValue"
2828
>
2929
<label
3030
class="admin__actions-switch-label"
3131
@click="toggleValueByClick"
32-
data-name="<?= $field->getCode() ?>"
33-
data-value="<?= $field->getScope() ?>.<?= $field->getCode() ?>"
32+
data-name="<?= $escaper->escapeHtml($field->getCode()) ?>"
33+
data-value="<?= $escaper->escapeHtml($field->getScope()) ?>.<?= $escaper->escapeHtml($field->getCode()) ?>"
3434
>
35-
<span class="admin__actions-switch-text" x-show="item.<?= $field->getCode() ?>">Yes</span>
36-
<span class="admin__actions-switch-text" x-show="!item.<?= $field->getCode() ?>">No</span>
35+
<span class="admin__actions-switch-text" x-show="item.<?= $escaper->escapeHtml($field->getCode()) ?>">Yes</span>
36+
<span class="admin__actions-switch-text" x-show="!item.<?= $escaper->escapeHtml($field->getCode()) ?>">No</span>
3737
</label>
3838
</div>

‎view/adminhtml/templates/form/field_type/text.phtml‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -22,12 +22,14 @@ if (isset($htmlAttributes['type'])) {
2222
?>
2323
<input
2424
class="admin__control-text"
25-
type="<?= $inputType ?>"
26-
name="<?= $field->getCode() ?>"
27-
data-name="<?= $field->getCode() ?>"
25+
type="<?= $escaper->escapeHtml($inputType) ?>"
26+
name="<?= $escaper->escapeHtml($field->getCode()) ?>"
27+
data-name="<?= $escaper->escapeHtml($field->getCode()) ?>"
2828
<?php foreach ($htmlAttributes as $htmlAttributeName => $htmlAttributeValue) : ?>
29-
<?= $htmlAttributeName ?>="<?= $htmlAttributeValue ?>"
29+
<?= /* @noEscape */
30+
$htmlAttributeName ?>="<?= /* @noEscape */
31+
$htmlAttributeValue ?>"
3032
<?php endforeach; ?>
31-
:value="<?= $field->getScope() ?>.<?= $field->getCode() ?>"
33+
:value="<?= $escaper->escapeHtml($field->getScope()) ?>.<?= $escaper->escapeHtml($field->getCode()) ?>"
3234
@change="setValue"
3335
>

‎view/adminhtml/templates/form/field_type/view.phtml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,4 +15,4 @@ $field = $block->getField();
1515
$fieldType = $field->getFieldType();
1616

1717
?>
18-
<div style="padding-top:8px;" x-html="<?= $field->getScope() ?>.<?= $field->getCode() ?>"></div>
18+
<div style="padding-top:8px;" x-html="<?= $escaper->escapeHtml($field->getScope()) ?>.<?= $escaper->escapeHtml($field->getCode()) ?>"></div>

‎view/adminhtml/templates/form/fieldset.phtml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,11 @@ use Magento\Framework\View\Element\Template;
77
?>
88
<div class="entry-edit form-inline">
99
<div class="fieldset-wrapper">
10-
<h1><?= $block->getLabel() ?></h1>
10+
<h1><?= $escaper->escapeHtml($block->getLabel()) ?></h1>
1111
<div class="admin__fieldset-wrapper-content">
1212
<fieldset class="admin__fieldset">
13-
<?= $block->getChildHtml() ?>
13+
<?= /* @noEscape */
14+
$block->getChildHtml() ?>
1415
</fieldset>
1516
</div>
1617
</div>

0 commit comments

Comments
 (0)