From 8b45ba9e75a5d911906e95c3980e214eff9e61b0 Mon Sep 17 00:00:00 2001
From: cweiske <cweiske@b3834d28-1941-0410-a4f8-b48e95affb8f>
Date: Sun, 26 Sep 2010 22:06:31 +0000
Subject: [PATCH] escape the installation name; html code was broken when one
 had quotes in the name

git-svn-id: https://semanticscuttle.svn.sourceforge.net/svnroot/semanticscuttle/trunk@750 b3834d28-1941-0410-a4f8-b48e95affb8f
---
 data/templates/bookmarks.tpl.php        |  5 +++-
 data/templates/sidebar.block.search.php | 37 ++++++++++++++++++-------
 data/templates/top.inc.php              |  9 ++++--
 3 files changed, 37 insertions(+), 14 deletions(-)

diff --git a/data/templates/bookmarks.tpl.php b/data/templates/bookmarks.tpl.php
index 2eed9c3..e32d3c9 100644
--- a/data/templates/bookmarks.tpl.php
+++ b/data/templates/bookmarks.tpl.php
@@ -215,7 +215,10 @@ if ($currenttag!= '') {
 	$brss = '';
 	$size = count($rsschannels);
 	for ($i = 0; $i < $size; $i++) {
-		$brss =  '<a style="background:#FFFFFF" href="'. $rsschannels[$i][1] .'" title="'. $rsschannels[$i][0] .'"><img src="'. ROOT .'images/rss.gif" width="16" height="16" alt="'. $rsschannels[$i][0] .'" /></a>';
+		$brss =  '<a style="background:#FFFFFF" href="'. htmlspecialchars($rsschannels[$i][1]) . '"'
+            . ' title="' . htmlspecialchars($rsschannels[$i][0]) . '">'
+            . '<img src="' . ROOT . 'images/rss.gif" width="16" height="16" alt="' . htmlspecialchars($rsschannels[$i][0]) .'"/>'
+            . '</a>';
 	}
 
 	$pagesBanner = '<p class="paging">'. $bfirst .'<span> / </span>'. $bprev .'<span> / </span>'. $bnext .'<span> / </span>'. $blast .'<span> / </span>'. sprintf(T_('Page %d of %d'), $page, $totalpages) ." ". $brss ." </p>\n";
diff --git a/data/templates/sidebar.block.search.php b/data/templates/sidebar.block.search.php
index 64cb8ac..660ce00 100644
--- a/data/templates/sidebar.block.search.php
+++ b/data/templates/sidebar.block.search.php
@@ -1,13 +1,26 @@
 <?php
+/**
+ * Show a list of the last searches.
+ *
+ * SemanticScuttle - your social bookmark manager.
+ *
+ * PHP version 5.
+ *
+ * @category    Bookmarking
+ * @package     SemanticScuttle
+ * @subcategory Templates
+ * @author      Benjamin Huynh-Kim-Bang <mensonge@users.sourceforge.net>
+ * @author      Christian Weiske <cweiske@cweiske.de>
+ * @author      Eric Dane <ericdane@users.sourceforge.net>
+ * @license     GPL http://www.gnu.org/licenses/gpl.html
+ * @link        http://sourceforge.net/projects/semanticscuttle
+ */
 /* Service creation: only useful services are created */
-$searchhistoryservice =SemanticScuttle_Service_Factory::get('SearchHistory');
+$searchhistoryservice = SemanticScuttle_Service_Factory::get('SearchHistory');
 
-$logged_on_userid = $userservice->getCurrentUserId();
-if ($logged_on_userid === false) {
-    $logged_on_userid = NULL;
-}
-
-$lastSearches = $searchhistoryservice->getAllSearches('all', NULL, 3, NULL, true, false);
+$lastSearches = $searchhistoryservice->getAllSearches(
+    'all', NULL, 3, NULL, true, false
+);
 
 if ($lastSearches && count($lastSearches) > 0) {
 ?>
@@ -18,11 +31,15 @@ if ($lastSearches && count($lastSearches) > 0) {
 <?php
 foreach ($lastSearches as $row) {
     echo '<tr><td>';
-    echo  '<a href="'.createURL('search', $range.'/'.$row['shTerms']).'">';
+    echo  '<a href="'
+        . htmlspecialchars(createURL('search', $range.'/'.$row['shTerms']))
+        . '">';
     echo $row['shTerms'];
     echo '</a>';
-    echo ' <span title="'.T_('Number of bookmarks for this query').'">('.$row['shNbResults'].')</span>';
-    echo '</td></tr>';
+    echo ' <span title="'
+        . T_('Number of bookmarks for this query')
+        . '">(' . $row['shNbResults'] . ')</span>';
+    echo '</td></tr>' . "\n";
 }
 //echo '<tr><td><a href="'.createURL('users').'">...</a></td></tr>';
 ?>
diff --git a/data/templates/top.inc.php b/data/templates/top.inc.php
index 830da65..b1ffa14 100644
--- a/data/templates/top.inc.php
+++ b/data/templates/top.inc.php
@@ -5,15 +5,18 @@
   <title><?php echo filter($GLOBALS['sitename'] .(isset($pagetitle) ? ' » ' . $pagetitle : '')); ?></title>
   <link rel="icon" type="image/png" href="<?php echo ROOT ?>icon.png" />
   <link rel="stylesheet" type="text/css" href="<?php echo ROOT ?>scuttle.css" />
-  <link rel="search" type="application/opensearchdescription+xml" href="<?php echo ROOT ?>api/opensearch.php" title="<?php echo $GLOBALS['sitename'] ?>"/>
+  <link rel="search" type="application/opensearchdescription+xml" href="<?php echo ROOT ?>api/opensearch.php" title="<?php echo htmlspecialchars($GLOBALS['sitename']) ?>"/>
 <?php
-if(isset($rsschannels)) {
+if (isset($rsschannels)) {
 	$size = count($rsschannels);
 	for ($i = 0; $i < $size; $i++) {
-		echo '  <link rel="alternate" type="application/rss+xml" title="'. $rsschannels[$i][0] .'" href="'. $rsschannels[$i][1] .'" />';
+		echo '  <link rel="alternate" type="application/rss+xml" title="'
+            . htmlspecialchars($rsschannels[$i][0]) . '"'
+            . ' href="'. $rsschannels[$i][1] .'" />';
 	}
 }
 ?>
+
   <link rel="stylesheet" type="text/css"
 	href="http://ajax.googleapis.com/ajax/libs/dojo/1.2/dijit/themes/nihilo/nihilo.css" />