Skip to content

Commit fd54f61

Browse files
jmontoyaajmontoyaa
committed
Fix course title add Security::remove_XSS
1 parent a145f71 commit fd54f61

File tree

3 files changed

+65
-41
lines changed

3 files changed

+65
-41
lines changed

‎main/auth/sort_my_courses.php

Lines changed: 35 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -306,27 +306,29 @@
306306
echo ' ';
307307
echo CourseManager::getTeacherListFromCourseCodeToString($course['code']);
308308
echo '<br />';
309-
310309
if (api_get_setting('display_teacher_in_courselist') === 'true') {
311310
echo $course['tutor'];
312311
}
313-
echo '</td><td valign="top">'; ?>
314-
<div style="float:left;width:110px;">
315-
<?php
316-
if (api_get_setting('show_courses_descriptions_in_catalog') == 'true') {
317-
$icon_title = get_lang('CourseDetails').' - '.$course['title']; ?>
318-
<a href="<?php echo api_get_path(WEB_CODE_PATH); ?>inc/ajax/course_home.ajax.php?a=show_course_information&code=<?php echo $course['code']; ?>" data-title="<?php echo $icon_title; ?>" title="<?php echo $icon_title; ?>" class="ajax">
319-
<?php
320-
echo Display::return_icon('info.png', $icon_title, '', '22');
321-
} ?>
322-
</a>
323-
<?php
312+
echo '</td><td valign="top">';
313+
echo '<div style="float:left;width:110px;">';
314+
if (api_get_setting('show_courses_descriptions_in_catalog') === 'true') {
315+
$icon_title = get_lang('CourseDetails').' - '.$course['title'];
316+
$url = api_get_path(
317+
WEB_CODE_PATH
318+
).'inc/ajax/course_home.ajax.php?a=show_course_information&code='.$course['code'];
319+
echo Security::remove_XSS(
320+
Display::url(
321+
Display::return_icon('info.png', $icon_title, '', '22'),
322+
$url,
323+
['class' => 'ajax', 'data-title' => $icon_title, 'title' => $icon_title]
324+
)
325+
);
324326
echo Display::url(
325327
Display::return_icon('edit.png', get_lang('Edit'), '', 22),
326328
$currentUrl.'?action=edit_course_category&category_id='.$row['id'].'&course_id='.$course['real_id'].'&sec_token='.$stok,
327329
['class' => 'ajax']
328330
);
329-
331+
}
330332
if ($key > 0) {
331333
?>
332334
<a href="<?php echo $currentUrl; ?>?action=<?php echo $action; ?>&amp;move=up&amp;course=<?php echo $course['code']; ?>&amp;category=<?php echo $course['user_course_cat']; ?>&amp;sec_token=<?php echo $stok; ?>">
@@ -390,16 +392,19 @@
390392
if (api_get_setting('display_teacher_in_courselist') === 'true') {
391393
echo $course['tutor'];
392394
}
393-
echo '</td><td class="text-right">'; ?>
394-
<div>
395-
<?php
396-
if (api_get_setting('show_courses_descriptions_in_catalog') == 'true') {
397-
$icon_title = get_lang('CourseDetails').' - '.$course['title']; ?>
398-
<a href="<?php echo api_get_path(WEB_CODE_PATH); ?>inc/ajax/course_home.ajax.php?a=show_course_information&code=<?php echo $course['code']; ?>" data-title="<?php echo $icon_title; ?>" title="<?php echo $icon_title; ?>" class="ajax">
399-
<?php echo Display::return_icon('info.png', $icon_title, '', '22'); ?>
400-
</a>
401-
<?php
402-
}
395+
echo '</td><td class="text-right">';
396+
echo '<div>';
397+
if (api_get_setting('show_courses_descriptions_in_catalog') === 'true') {
398+
$icon_title = get_lang('CourseDetails').' - '.$course['title'];
399+
$url = api_get_path(WEB_CODE_PATH).'inc/ajax/course_home.ajax.php?a=show_course_information&code='.$course['code'];
400+
echo Security::remove_XSS(
401+
Display::url(
402+
Display::return_icon('info.png', $icon_title, '', '22'),
403+
$url,
404+
['class' => 'ajax', 'data-title' => $icon_title, 'title' => $icon_title]
405+
)
406+
);
407+
}
403408
echo '';
404409
if (isset($_GET['edit']) && $course['code'] == $_GET['edit']) {
405410
echo Display::return_icon('edit_na.png', get_lang('Edit'), '', 22);
@@ -412,7 +417,8 @@
412417
}
413418
if ($key > 0) {
414419
?>
415-
<a href="<?php echo $currentUrl; ?>?action=<?php echo $action; ?>&amp;move=up&amp;course=<?php echo $course['code']; ?>&amp;category=<?php echo $course['user_course_cat']; ?>&amp;sec_token=<?php echo $stok; ?>">
420+
<a
421+
href="<?php echo $currentUrl; ?>?action=<?php echo $action; ?>&amp;move=up&amp;course=<?php echo $course['code']; ?>&amp;category=<?php echo $course['user_course_cat']; ?>&amp;sec_token=<?php echo $stok; ?>">
416422
<?php echo Display::display_icon('up.png', get_lang('Up'), '', 22); ?>
417423
</a>
418424
<?php
@@ -421,7 +427,8 @@
421427
}
422428
if ($key < $number_of_courses - 1) {
423429
?>
424-
<a href="<?php echo $currentUrl; ?>?action=<?php echo $action; ?>&amp;move=down&amp;course=<?php echo $course['code']; ?>&amp;category=<?php echo $course['user_course_cat']; ?>&amp;sec_token=<?php echo $stok; ?>">
430+
<a
431+
href="<?php echo $currentUrl; ?>?action=<?php echo $action; ?>&amp;move=down&amp;course=<?php echo $course['code']; ?>&amp;category=<?php echo $course['user_course_cat']; ?>&amp;sec_token=<?php echo $stok; ?>">
425432
<?php echo Display::display_icon('down.png', get_lang('Down'), '', 22); ?>
426433
</a>
427434
<?php
@@ -435,7 +442,9 @@
435442
if ($course['unsubscr'] == 1) {
436443
?>
437444
<!-- changed link to submit to avoid action by the search tool indexer -->
438-
<form action="<?php echo api_get_self(); ?>" method="post" onsubmit="javascript: if (!confirm('<?php echo addslashes(api_htmlentities(get_lang("ConfirmUnsubscribeFromCourse"), ENT_QUOTES, api_get_system_encoding())); ?>')) return false;">
445+
<form action="<?php echo api_get_self(); ?>"
446+
method="post"
447+
onsubmit="javascript: if (!confirm('<?php echo addslashes(api_htmlentities(get_lang("ConfirmUnsubscribeFromCourse"), ENT_QUOTES, api_get_system_encoding())); ?>')) return false;">
439448
<input type="hidden" name="sec_token" value="<?php echo $stok; ?>">
440449
<input type="hidden" name="unsubscribe" value="<?php echo $course['code']; ?>" />
441450
<button class="btn btn-default" value="<?php echo get_lang('Unsubscribe'); ?>" name="unsub">

‎main/template/default/layout/hot_course_item.tpl

Lines changed: 20 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,12 @@
33
<div class="col-xs-12 col-sm-6 col-md-4">
44
<div class="items items-hotcourse">
55
<div class="image">
6-
<a title="{{ item.title}}" href="{{ _p.web }}course/{{ item.real_id }}/about">
7-
<img src="{{ item.course_image_large }}" class="img-responsive" alt="{{ item.title }}">
8-
</a>
6+
{% set title %}
7+
<a title="{{ item.title}}" href="{{ _p.web }}course/{{ item.real_id }}/about">
8+
<img src="{{ item.course_image_large }}" class="img-responsive" alt="{{ item.title }}">
9+
</a>
10+
{% endset %}
11+
{{ title | remove_xss }}
912

1013
{% if item.categoryName != '' %}
1114
<span class="category">{{ item.categoryName }}</span>
@@ -15,17 +18,20 @@
1518
</div>
1619
<div class="description">
1720
<div class="block-title">
18-
<h5 class="title">
19-
{% if item.is_course_student or item.is_course_teacher %}
20-
<a alt="{{ item.title }}" title="{{ item.title }}" href="{{ _p.web }}courses/{{ item.directory }}/">
21-
{{ item.title_cut}}
22-
</a>
23-
{% else %}
24-
<a alt="{{ item.title }}" title="{{ item.title }}" href="{{ _p.web }}course/{{ item.real_id }}/about">
25-
{{ item.title_cut}}
26-
</a>
27-
{% endif %}
28-
</h5>
21+
{% set title %}
22+
<h5 class="title">
23+
{% if item.is_course_student or item.is_course_teacher %}
24+
<a alt="{{ item.title }}" title="{{ item.title }}" href="{{ _p.web }}courses/{{ item.directory }}/">
25+
{{ item.title_cut}}
26+
</a>
27+
{% else %}
28+
<a alt="{{ item.title }}" title="{{ item.title }}" href="{{ _p.web }}course/{{ item.real_id }}/about">
29+
{{ item.title_cut}}
30+
</a>
31+
{% endif %}
32+
</h5>
33+
{% endset %}
34+
{{ title | remove_xss }}
2935
</div>
3036
<div class="ranking">
3137
{{ item.rating_html }}

‎main/template/default/user_portal/grid_courses_without_category.tpl

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,12 @@
1111
{% if item.visibility == constant('COURSE_VISIBILITY_CLOSED') and not item.current_user_is_teacher %}
1212
<img src="{{ item.image }}" class="img-responsive">
1313
{% else %}
14+
{% set title %}
1415
<a title="{{ item.title }}" href="{{ item.link }}">
1516
<img src="{{ item.image }}" alt="{{ item.title }}" class="img-responsive">
1617
</a>
18+
{% endset %}
19+
{{ title | remove_xss }}
1720
{% endif %}
1821
{% if item.category != '' %}
1922
<span class="category">{{ item.category }}</span>
@@ -38,6 +41,7 @@
3841
</div>
3942
<div class="description">
4043
<div class="block-title">
44+
{% set title %}
4145
<h4 class="title" title="{{ item.title }}">
4246
{% if item.visibility == constant('COURSE_VISIBILITY_CLOSED') and not item.current_user_is_teacher %}
4347
{{ item.title_cut }}
@@ -47,10 +51,15 @@
4751
<span class="code-title">{{ item.code_course }}</span>{{ item.url_marker }}
4852
{% endif %}
4953
</h4>
54+
{% endset %}
55+
{{ title | remove_xss }}
5056
</div>
5157
<div class="block-author">
5258
{% if item.teachers | length > 6 %}
53-
<a id="plist-{{ loop.index }}" data-trigger="focus" tabindex="0" role="button" class="btn btn-default panel_popover" data-toggle="popover" title="{{ 'CourseTeachers' | get_lang }}" data-html="true">
59+
<a id="plist-{{ loop.index }}"
60+
data-trigger="focus" tabindex="0" role="button"
61+
class="btn btn-default panel_popover" data-toggle="popover"
62+
title="{{ 'CourseTeachers' | get_lang }}" data-html="true">
5463
<i class="fa fa-graduation-cap" aria-hidden="true"></i>
5564
</a>
5665
<div id="popover-content-plist-{{ loop.index }}" class="hide">

0 commit comments

Comments
 (0)