Explicitly declare noescape

common/tpl/common_layout.html

@@ -44,7 +44,7 @@
 <block loop="Context::getOpenGraphData() => $og_metadata">
 <meta property="{$og_metadata['property']}" content="{$og_metadata['content']}" />
 </block>
-{Context::getHtmlHeader()}
+{Context::getHtmlHeader()|noescape}
 
 <!-- COMMON JS VARIABLES -->
 <script>
@@ -63,12 +63,12 @@
 </head>
 
 <!-- BODY START -->
-<body{Context::getBodyClass()}>
+<body{Context::getBodyClass()|noescape}>
 
 <!-- PAGE CONTENT -->
-{Context::getBodyHeader()}
-{$content}
-{Context::getHtmlFooter()}
+{Context::getBodyHeader()|noescape}
+{$content|noescape}
+{Context::getHtmlFooter()|noescape}
 
 <!-- ETC -->
 <div id="rhymix_waiting" class="wfsr" cond="!$m">{$lang->msg_call_server}</div>

common/tpl/default_layout.html

@@ -1 +1 @@
-{$content}
+{$content|noescape}

common/tpl/popup_layout.html

@@ -1,7 +1,7 @@
 <load target="../../modules/admin/tpl/css/admin.bootstrap.css" />
 <load target="../../modules/admin/tpl/css/admin.css" />
 <div class="x popup">
-    {$content}
+    {$content|noescape}
 </div>
 <script>
 	jQuery(function() {

layouts/default/layout.html

@@ -98,7 +98,7 @@
 		<!-- /LNB -->
 		<!-- CONTENT -->
 		<div class="content" id="content">
-			{$content}
+			{$content|noescape}
 		</div>
 		<!-- /CONTENT -->
 	</div>

layouts/simple_world/layout.html

@@ -138,9 +138,9 @@
 			</section>
 		</div>
 		<div class="layout_content" id="content">
-			{$layout_info->before_content}
-			{$content}
-			{$layout_info->after_content}
+			{$layout_info->before_content|noescape}
+			{$content|noescape}
+			{$layout_info->after_content|noescape}
 		</div>
 		<!--// CONTENT -->
 		<div class="layout_outright" cond="trim($layout_info->right_content)">

layouts/user_layout/layout.html

@@ -40,7 +40,7 @@
 			</ul>
 		</div>
 		<hr />
-		<div class="content">.content{$content}</div>
+		<div class="content">.content{$content|noescape}</div>
 	</div>
 	<hr />
 	<div class="footer">.footer</div>

layouts/xedition/layout.html

@@ -371,7 +371,7 @@
 		<!-- /LNB -->
 		<!-- CONTENT -->
 			<div class="content" id="content">
-				{$content}
+				{$content|noescape}
 			</div>
 			<!--@if($layout_info->use_demo === 'Y')-->
 				<include target="./demo/welcome_main.html" />

m.layouts/colorCode/layout.html

@@ -24,7 +24,7 @@
 </header>
 <hr class="head_hr" />
 <section id="ct" class="ct">
-{$content}
+{$content|noescape}
 </section>
 <footer class="lo_foot">
 	<ul class="link">

m.layouts/default/layout.html

@@ -19,7 +19,7 @@
 		<!--@end-->
 	<!--@end-->
 </div>
-{$content}
+{$content|noescape}
 <ul class="ft">
 	<!--@if($is_logged)-->
 	<li class="fl"><a href="{getUrl('act','dispMemberLogout')}">{$lang->cmd_logout}</a></li>

m.layouts/simpleGray/layout.html

@@ -5,7 +5,7 @@
 	<div class="fr"><a href="{getUrl('act','dispMenuMenu','menu_srl',$layout_info->menu->main_menu->menu_srl)}" class="bn">{$lang->menu}</a></div>
 	<!--@end-->
 </div>
-{$content}
+{$content|noescape}
 <ul class="eg ft">
 	<!--@if($is_logged)-->
 	<li class="fl"><a href="{getUrl('act','dispMemberLogout')}">{$lang->cmd_logout}</a></li>

modules/admin/tpl/layout.html

@@ -6,7 +6,7 @@
 			{$lang->get('admin.msg_blacklisted_reason.'.$blacklisted_plugin_name)}
 		</p>
 	</div>
-	{$content}
+	{$content|noescape}
 </div>
 <include target="./_footer.html" />
 

modules/admin/tpl/popup_layout.html

@@ -1,7 +1,7 @@
 <include target="./_admin_common.html" />
 <div class="x">
 	<div class="content" id="content">
-		{$content}
+		{$content|noescape}
 	</div>
 </div>
 <script>opener.top.fullSetupWinLoaded();</script>

modules/communication/m.skins/default/read_message.html

@@ -4,7 +4,7 @@
 	<h2>{$message->title}</h2><span class="ex">{$message->nick_name} | {zdate($message->regdate, "Y.m.d H:i")}</span>
 </div>
 <div class="co">
-	<div class="xe_content">{$message->content}</div>
+	<div class="xe_content">{$message->content|noescape}</div>
 </div>
 <div class="bna">
 	<span class="fl"><a href="{getUrl('message_srl', '')}" class="bn white">{$lang->cmd_list}</a></span>

modules/communication/m.skins/default/send_message.html

@@ -35,7 +35,7 @@
 			<input type="text" name="title" id="message_title" value="{$source_message->title}"/>
 		</li>
 		<li class="xe_content">
-			{$source_message->content}
+			{$source_message->content|noescape}
 		</li>
 		<li>
 			<label for="message_content">{$lang->content}</label>

modules/communication/m.skins/rx_prn/new_message.html

@@ -7,7 +7,7 @@
 			<a href="popup_menu_area" class="member_{$message->member_srl}">{$message->nick_name}</a> / {zdate($message->regdate, "Y-m-d H:i")}
 		</div>
 		<div class="xe_content">
-			{$message->content}
+			{$message->content|noescape}
 		</div>
 		<div class="prn-anchor-buttons">
 			<a cond="$message->message_type != 'S' && $message->member_srl != $logged_info->member_srl" href="#" onclick="doSendMessage('{$message->sender_srl}','{$message->message_srl}');">{$lang->cmd_reply_message}</a>

modules/communication/m.skins/rx_prn/send_message.html

@@ -30,7 +30,7 @@
 				<label for="message_send_mail"><input type="checkbox" value="Y" name="send_mail" id="message_send_mail" /> {$lang->cmd_send_mail}</label>
 				<div class="rx_prn-notice info">{$lang->msg_send_mail_privacy}</div>
 			</div>
-			{$editor}
+			{$editor|noescape}
 			<div class="control-group">
 				<input type="submit" value="{$lang->cmd_send_message}" />
 			</div>

modules/communication/skins/default/messages.html

@@ -29,7 +29,7 @@
 	</tr>
 	<tr>
 		<td class="xe_content">
-			{$message->content}
+			{$message->content|noescape}
 		</td>
 	</tr>
 </table>

modules/communication/skins/default/new_message.html

@@ -14,7 +14,7 @@
 			<td>{htmlspecialchars($message->title, ENT_COMPAT | ENT_HTML401, 'UTF-8', false)}</td>
 		</tr>
 		<tr>
-			<td colspan="2" class="xe_content">{$message->content}</td>
+			<td colspan="2" class="xe_content">{$message->content|noescape}</td>
 		</tr>
 	</table>
 	<div class="btnArea">

modules/communication/skins/default/send_message.html

@@ -35,7 +35,7 @@
 				<td><input type="checkbox" value="Y" name="send_mail" /> {$lang->cmd_send_mail} <span class="explanation">{$lang->msg_send_mail_privacy}</span></td>
 			</tr>
 		</table>
-		{$editor}
+		{$editor|noescape}
 		<div class="btnArea">
 			<input type="submit" value="{$lang->cmd_send_message}" class="btn btn-inverse" />
 		</div>

modules/communication/skins/simple_world/new_message.html

@@ -6,7 +6,7 @@
 		<a href="popup_menu_area" class="member_{$message->member_srl}">{$message->nick_name}</a> / {zdate($message->regdate, "Y-m-d H:i")}
 	</div>
 	<div class="xe_content">
-		{$message->content}
+		{$message->content|noescape}
 	</div>
 	<div class="sw-footer sw-anchor-buttons">
 		<a cond="$message->message_type != 'S' && $message->member_srl != $logged_info->member_srl" href="#" onclick="doSendMessage('{$message->sender_srl}','{$message->message_srl}');">{$lang->cmd_reply_message}</a>

modules/communication/skins/simple_world/send_message.html

@@ -29,7 +29,7 @@
 				<br>{$lang->msg_allow_message_please}
 			</div>
 		</div>
-		{$editor}
+		{$editor|noescape}
 		<div class="control-group">
 			<input type="submit" value="{$lang->cmd_send_message}" />
 		</div>

modules/editor/tpl/config_preview.html

@@ -1,5 +1,5 @@
 	<form onSubmit="return false">	
 		<input type="hidden" name="dummy_content" />
 		<input type="hidden" name="dummy_key" value="1" />
-		<p>{$editor}</p>
+		<p>{$editor|noescape}</p>
 	</form>

modules/editor/tpl/editor_frame.html

@@ -14,5 +14,5 @@
 <form>
 	<input type="hidden" name="primary_key" id="primary_key" value="" />
 	<input type="hidden" name="content" id="content" value="" />
-	{$editor}
+	{$editor|noescape}
 </form>

modules/editor/tpl/popup.html

@@ -1,3 +1,3 @@
 <div>
-{$popup_content}
+{$popup_content|noescape}
 </div>

modules/editor/tpl/preview.html

@@ -1,4 +1,4 @@
 <script>
     top.xAddEventListener(window, 'load', function() { top.showPreviewContent({$editor_sequence}); } );
 </script>
-{$content}
+{$content|noescape}

modules/layout/tpl/layout_modify.html

@@ -1,3 +1,3 @@
 <load target="js/layout_modify.js" />
 <include target="header.html" />
-{$content}
+{$content|noescape}

modules/widget/tpl/add_content_widget.html

@@ -15,7 +15,7 @@
 	</div>
 	<div class="x_modal-body">
 		<div class="pageAddContent"></div>
-		<div class="editor">{$editor}</div>
+		<div class="editor">{$editor|noescape}</div>
 		<script>xAddEventListener(window, 'load', doSyncPageContent);</script>
 	</div>
 	<div class="x_modal-footer">