From 6abd345dcfb3e4c98445c8912454d4364718d286 Mon Sep 17 00:00:00 2001 From: Kijin Sung Date: Wed, 10 Oct 2018 14:43:43 +0900 Subject: [PATCH] Fix autoescape problems MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - 삼항식 사용시 autoescape 우선순위가 꼬이는 문제 수정 - $lang 변수는 autoescape하지 않도록 변경 - ENT_COMPAT을 ENT_QUOTES로 변경 (자바스크립트에서 사용시 '홑따옴표' 이탈 방지) --- classes/template/TemplateHandler.class.php | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/classes/template/TemplateHandler.class.php b/classes/template/TemplateHandler.class.php index 5d671980d..d24b2e742 100644 --- a/classes/template/TemplateHandler.class.php +++ b/classes/template/TemplateHandler.class.php @@ -557,6 +557,10 @@ class TemplateHandler { $escape_option = 'noescape'; } + elseif(preg_match('/^\$(?:user_)?lang->[a-zA-Z0-9\_]+$/', $m[1])) + { + $escape_option = 'noescape'; + } else { $escape_option = $this->config->autoescape !== null ? 'auto' : 'noescape'; @@ -894,14 +898,14 @@ class TemplateHandler switch($escape_option) { case 'escape': - return "htmlspecialchars({$str}, ENT_COMPAT, 'UTF-8', true)"; + return "htmlspecialchars({$str}, ENT_QUOTES, 'UTF-8', true)"; case 'noescape': return "{$str}"; case 'autoescape': - return "htmlspecialchars({$str}, ENT_COMPAT, 'UTF-8', false)"; + return "htmlspecialchars({$str}, ENT_QUOTES, 'UTF-8', false)"; case 'auto': default: - return "(\$this->config->autoescape === 'on' ? htmlspecialchars({$str}, ENT_COMPAT, 'UTF-8', false) : {$str})"; + return "(\$this->config->autoescape === 'on' ? htmlspecialchars({$str}, ENT_QUOTES, 'UTF-8', false) : ({$str}))"; } }