Merge branch 'development' of https://github.com/PrestaShop/PrestaShop into development

admin-dev/get-file-admin.php

@@ -25,5 +25,5 @@
 */
 
 define('_PS_ADMIN_DIR_', getcwd());
-require(_PS_ADMIN_DIR_.'/config/config.inc.php');
+require(_PS_ADMIN_DIR_.'/../config/config.inc.php');
 Controller::getController('GetFileController')->run();

admin-dev/themes/default/template/controllers/access/helpers/form/form.tpl

@@ -52,7 +52,7 @@
 				checked = enabled ? 'checked': '';
 				$(this).parent().parent().parent().find('.child-'+id_tab+' input[type=checkbox]').attr('checked', checked);
 				$.ajax({
-					url: "{$link->getAdminLink('AdminAccess')}",
+					url: "{$link->getAdminLink('AdminAccess')|addslashes}",
 					cache: false,
 					data : {
 						ajaxMode : '1',
@@ -85,7 +85,7 @@
 			perfect_access_js_gestion(this, perm, id_tab, tabsize, tabnumber, table);
 
 			$.ajax({
-				url: "{$link->getAdminLink('AdminAccess')}",
+				url: "{$link->getAdminLink('AdminAccess')|addslashes}",
 				cache: false,
 				data : {
 					ajaxMode : '1',
@@ -134,7 +134,7 @@
 				});
 
 			$.ajax({
-				url: "{$link->getAdminLink('AdminAccess')}",
+				url: "{$link->getAdminLink('AdminAccess')|addslashes}",
 				cache: false,
 				data : {
 					ajaxMode: '1',

admin-dev/themes/default/template/controllers/employees/helpers/form/form.tpl

@@ -60,7 +60,7 @@
 			ifSuperAdmin($(this));
 
 			$.ajax({
-				url: "{$link->getAdminLink('AdminEmployees')}",
+				url: "{$link->getAdminLink('AdminEmployees')|addslashes}",
 				cache: false,
 				data : {
 					ajax : '1',

admin-dev/themes/default/template/controllers/information/helpers/view/view.tpl

@@ -32,7 +32,7 @@
 		{
 			$.ajax({
 				type: 'GET',
-				url: '{$link->getAdminLink('AdminInformation')}',
+				url: '{$link->getAdminLink('AdminInformation')|addslashes}',
 				data: {
 					'action': 'checkFiles',
 					'ajax': 1

admin-dev/themes/default/template/controllers/orders/form.tpl

@@ -28,7 +28,7 @@
 	var changed_shipping_price = false;
 	var shipping_price_selected_carrier = '';
 	var current_index = '{$current}&token={$token}';
-	var admin_cart_link = '{$link->getAdminLink('AdminCarts')}';
+	var admin_cart_link = '{$link->getAdminLink('AdminCarts')|escape:'html'}';
 	var cart_quantity = new Array();
 	var currencies = new Array();
 	var id_currency = '';
@@ -100,7 +100,7 @@
 		$('#show_old_carts').click();
 		$('#payment_module_name').change();
 		$.ajaxSetup({ type:"post" });
-		$("#voucher").autocomplete('{$link->getAdminLink('AdminCartRules')}', {
+		$("#voucher").autocomplete('{$link->getAdminLink('AdminCartRules')|escape:'html'}', {
 					minChars: 3,
 					max: 15,
 					width: 250,
@@ -157,7 +157,7 @@
 				free_shipping = 1;
 			$.ajax({
 				type:"POST",
-				url: "{$link->getAdminLink('AdminCarts')}",
+				url: "{$link->getAdminLink('AdminCarts')|addslashes}",
 				async: true,
 				dataType: "json",
 				data : {
@@ -217,7 +217,7 @@
 			e.preventDefault();
 			$.ajax({
 				type:"POST",
-				url: "{$link->getAdminLink('AdminCarts')}",
+				url: "{$link->getAdminLink('AdminCarts')|addslashes}",
 				async: true,
 				dataType: "json",
 				data : {
@@ -254,7 +254,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')}",
+			url: "{$link->getAdminLink('AdminCarts')|addslashes}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -288,7 +288,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')}",
+			url: "{$link->getAdminLink('AdminCarts')|addslashes}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -324,7 +324,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')}",
+			url: "{$link->getAdminLink('AdminCarts')|addslashes}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -351,7 +351,7 @@
 		$('#id_cart').val(id_cart);
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')}",
+			url: "{$link->getAdminLink('AdminCarts')|addslashes}",
 			async: false,
 			dataType: "json",
 			data : {
@@ -378,7 +378,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')}",
+			url: "{$link->getAdminLink('AdminCarts')|addslashes}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -401,7 +401,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')}",
+			url: "{$link->getAdminLink('AdminCarts')|addslashes}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -426,7 +426,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url : "{$link->getAdminLink('AdminOrders')}",
+			url : "{$link->getAdminLink('AdminOrders')|escape:'html'}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -468,7 +468,7 @@
 		$('#new_address').attr('href', address_link.replace(/id_customer=[0-9]+/, 'id_customer='+id_customer));
 		$.ajax({
 			type:"POST",
-			url : "{$link->getAdminLink('AdminCarts')}",
+			url : "{$link->getAdminLink('AdminCarts')|escape:'html'}",
 			async: false,
 			dataType: "json",
 			data : {
@@ -534,7 +534,7 @@
 		$('#products_part').show();
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminOrders')}",
+			url: "{$link->getAdminLink('AdminOrders')|addslashes}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -766,7 +766,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')}",
+			url: "{$link->getAdminLink('AdminCarts')|addslashes}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -822,7 +822,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')}",
+			url: "{$link->getAdminLink('AdminCarts')|addslashes}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -845,7 +845,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')}",
+			url: "{$link->getAdminLink('AdminCarts')|addslashes}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -868,7 +868,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')}",
+			url: "{$link->getAdminLink('AdminCarts')|addslashes}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -899,7 +899,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminOrders')}",
+			url: "{$link->getAdminLink('AdminOrders')|addslashes}",
 			async: true,
 			dataType: "json",
 			data : {
@@ -957,7 +957,7 @@
 	{
 		$.ajax({
 			type:"POST",
-			url: "{$link->getAdminLink('AdminCarts')}",
+			url: "{$link->getAdminLink('AdminCarts')|addslashes}",
 			async: true,
 			dataType: "json",
 			data : {

admin-dev/themes/default/template/controllers/orders/helpers/view/view.tpl

@@ -27,7 +27,7 @@
 
 {block name="override_tpl"}
 	<script type="text/javascript">
-	var admin_order_tab_link = "{$link->getAdminLink('AdminOrders')}";
+	var admin_order_tab_link = "{$link->getAdminLink('AdminOrders')|escape:'html'}";
 	var id_order = {$order->id};
 	var id_lang = {$current_id_lang};
 	var id_currency = {$order->id_currency};
@@ -59,7 +59,7 @@
 
 	{assign var="hook_invoice" value={hook h="displayInvoice" id_order=$order->id}}
 	{if ($hook_invoice)}
-	<div style="float: right; margin: -40px 40px 10px 0;">{$hook_invoice}</div><br class="clear" />';
+	<div style="float: right; margin: -40px 40px 10px 0;">{$hook_invoice}</div><br class="clear" />
 	{/if}
 
 <div class="bloc-command">

admin-dev/themes/default/template/controllers/products/informations.tpl

@@ -43,7 +43,7 @@
 				$('document').ready( function() {
 					$(".check_product_name")
 						.autocomplete(
-							'{$link->getAdminLink('AdminProducts', true)}', {
+							'{$link->getAdminLink('AdminProducts', true)|escape:'html'}', {
 								minChars: 3,
 								max: 10,
 								width: $(".check_product_name").width(),

admin-dev/themes/default/template/controllers/products/prices.tpl

@@ -25,7 +25,7 @@
 
 <script type="text/javascript">
 var Customer = new Object();
-var product_url = '{$link->getAdminLink('AdminProducts', true)}';
+var product_url = '{$link->getAdminLink('AdminProducts', true)|addslashes}';
 var ecotax_tax_excl = parseFloat({$ecotax_tax_excl});
 $(document).ready(function () {
 	Customer = {
@@ -56,7 +56,7 @@ $(document).ready(function () {
 			Customer.showLoader();
 			jQuery.ajax({
 				"type": "POST",
-				"url": "{$link->getAdminLink('AdminCustomers')}",
+				"url": "{$link->getAdminLink('AdminCustomers')|addslashes}",
 				"async": true,
 				"dataType": "json",
 				"data": {

admin-dev/themes/default/template/controllers/shop/tree.tpl

@@ -186,7 +186,7 @@ $("#multishop-tree").jstree({
 	'plugins': ["themes","json_data","cookies","contextmenu"],
 	'json_data': {
 		'ajax': {
-			'url': "{$link->getAdminLink('AdminShop')}",
+			'url': "{$link->getAdminLink('AdminShop')|addslashes}",
 			'data': function(n)
 			{
 				return {

classes/Address.php

@@ -222,7 +222,7 @@ class AddressCore extends ObjectModel
 	public function validateController($htmlentities = true)
 	{
 		$errors = parent::validateController($htmlentities);
-		if (!Configuration::get('VATNUMBER_CHECKING'))
+		if (!Configuration::get('VATNUMBER_MANAGEMENT') || !Configuration::get('VATNUMBER_CHECKING'))
 			return $errors;
 		include_once(_PS_MODULE_DIR_.'vatnumber/vatnumber.php');
 		if (class_exists('VatNumber', false))

classes/Blowfish.php

@@ -42,7 +42,7 @@ class BlowfishCore extends Crypt_Blowfish
 			$piece = substr($paddedtext, $x, 8);
 			$cipher_piece = parent::encrypt($piece);
 			$encoded = base64_encode($cipher_piece); 
-			$ciphertext = $ciphertext.$encoded;       
+			$ciphertext = $ciphertext.$encoded;
 		}
 	   return $ciphertext.sprintf('%06d', $length);  
 	}

classes/Cart.php

@@ -631,8 +631,8 @@ class CartCore extends ObjectModel
 			{
 				$row2 = Db::getInstance()->getRow('
 					SELECT image_shop.`id_image` id_image, il.`legend`
-					FROM `'._DB_PREFIX_.'image` i'.
+					FROM `'._DB_PREFIX_.'image` i
-					Shop::addSqlAssociation('image', 'i', false, 'image_shop.cover=1').'
+					JOIN `'._DB_PREFIX_.'image_shop` image_shop ON (i.id_image = image_shop.id_image AND image_shop.cover=1 AND image_shop.id_shop='.(int)$row['id_shop'].')
 					LEFT JOIN `'._DB_PREFIX_.'image_lang` il ON (image_shop.`id_image` = il.`id_image` AND il.`id_lang` = '.(int)$this->id_lang.')
 					WHERE i.`id_product` = '.(int)$row['id_product'].' AND image_shop.`cover` = 1'
 				);

classes/CartRule.php

@@ -637,7 +637,8 @@ class CartRuleCore extends ObjectModel
 							FROM `'._DB_PREFIX_.'cart_product` cp
 							LEFT JOIN `'._DB_PREFIX_.'category_product` catp ON cp.id_product = catp.id_product
 							WHERE cp.`id_cart` = '.(int)$context->cart->id.'
-							AND cp.`id_product` IN ('.implode(array_map('intval', $eligibleProductsList), ',').')');
+							AND cp.`id_product` IN ('.implode(array_map('intval', $eligibleProductsList), ',').')
+							AND cp.`id_product` <> '.(int)$this->gift_product);
 							$countMatchingProducts = 0;
 							$matchingProductsList = array();
 							foreach ($cartCategories as $cartCategory)

classes/Cookie.php

@@ -44,15 +44,13 @@ class CookieCore
 	/** @var array cipher tool instance */
 	protected $_cipherTool;
 
-	/** @var array cipher tool initialization key */
-	protected $_key;
-
-	/** @var array cipher tool initilization vector */
-	protected $_iv;
-
 	protected $_modified = false;
 	
 	protected $_allow_writing;
+	
+	protected $_salt;
+	
+	protected $_standalone;
 
 	/**
 	 * Get data if the cookie exists and else initialize an new one
@@ -60,24 +58,26 @@ class CookieCore
 	 * @param $name Cookie name before encrypting
 	 * @param $path
 	 */
-	public function __construct($name, $path = '', $expire = null, $shared_urls = null)
+	public function __construct($name, $path = '', $expire = null, $shared_urls = null, $standalone = false)
 	{
 		$this->_content = array();
+		$this->_standalone = $standalone;
 		$this->_expire = is_null($expire) ? time() + 1728000 : (int)$expire;
-		$this->_name = md5(_PS_VERSION_.$name);
+		$this->_name = md5(($this->_standalone ? '' : _PS_VERSION_).$name);
-		$this->_path = trim(Context::getContext()->shop->physical_uri.$path, '/\\').'/';
+		$this->_path = trim(($this->_standalone ? '' : Context::getContext()->shop->physical_uri).$path, '/\\').'/';
 		if ($this->_path{0} != '/') $this->_path = '/'.$this->_path;
 		$this->_path = rawurlencode($this->_path);
 		$this->_path = str_replace('%2F', '/', $this->_path);
 		$this->_path = str_replace('%7E', '~', $this->_path);
-		$this->_key = _COOKIE_KEY_;
-		$this->_iv = _COOKIE_IV_;
 		$this->_domain = $this->getDomain($shared_urls);
 		$this->_allow_writing = true;
-		if (Configuration::get('PS_CIPHER_ALGORITHM'))
+		$this->_salt = $this->_standalone ? str_pad('', 8, md5('ps'.__FILE__)) : _COOKIE_IV_;
-			$this->_cipherTool = new Rijndael(_RIJNDAEL_KEY_, _RIJNDAEL_IV_);
+		if ($this->_standalone)
+			$this->_cipherTool = new Blowfish(str_pad('', 56, md5('ps'.__FILE__)), str_pad('', 56, md5('iv'.__FILE__)));
+		elseif (!Configuration::get('PS_CIPHER_ALGORITHM'))
+			$this->_cipherTool = new Blowfish(_COOKIE_KEY_, _COOKIE_IV_);
 		else
-			$this->_cipherTool = new Blowfish($this->_key, $this->_iv);
+			$this->_cipherTool = new Rijndael(_RIJNDAEL_KEY_, _RIJNDAEL_IV_);
 		$this->update();
 	}
 
@@ -270,7 +270,7 @@ class CookieCore
 			//printf("\$content = %s<br />", $content);
 			
 			/* Get cookie checksum */
-			$checksum = crc32($this->_iv.substr($content, 0, strrpos($content, '¤') + 2));
+			$checksum = crc32($this->_salt.substr($content, 0, strrpos($content, '¤') + 2));
 			//printf("\$checksum = %s<br />", $checksum);
 			
 			/* Unserialize cookie content */
@@ -297,7 +297,7 @@ class CookieCore
 			$this->_content['date_add'] = date('Y-m-d H:i:s');
 
 		//checks if the language exists, if not choose the default language
-		if (!Language::getLanguage((int)$this->id_lang))
+		if (!$this->_standalone && !Language::getLanguage((int)$this->id_lang))
 			$this->id_lang = Configuration::get('PS_LANG_DEFAULT');
 
 	}
@@ -344,7 +344,7 @@ class CookieCore
 			$cookie .= $key.'|'.$value.'¤';
 
 		/* Add checksum to cookie */
-		$cookie .= 'checksum|'.crc32($this->_iv.$cookie);
+		$cookie .= 'checksum|'.crc32($this->_salt.$cookie);
 		$this->_modified = false;
 		/* Cookies are encrypted for evident security reasons */
 		return $this->_setcookie($cookie);

classes/Feature.php

@@ -81,7 +81,7 @@ class FeatureCore extends ObjectModel
 	public static function getFeatures($id_lang, $with_shop = true)
 	{
 		return Db::getInstance()->executeS('
-		SELECT *
+		SELECT DISTINCT f.id_feature, f.*, fl.*
 		FROM `'._DB_PREFIX_.'feature` f
 		'.($with_shop ? Shop::addSqlAssociation('feature', 'f') : '').'
 		LEFT JOIN `'._DB_PREFIX_.'feature_lang` fl ON (f.`id_feature` = fl.`id_feature` AND fl.`id_lang` = '.(int)$id_lang.')

classes/Language.php

@@ -580,7 +580,7 @@ class LanguageCore extends ObjectModel
 
 	public static function getLanguage($id_lang)
 	{
-		if (!array_key_exists((int)($id_lang), self::$_LANGUAGES))
+		if (!array_key_exists((int)$id_lang, self::$_LANGUAGES))
 			return false;
 		return self::$_LANGUAGES[(int)($id_lang)];
 	}

classes/LocalizationPack.php

@@ -294,7 +294,7 @@ class LocalizationPackCore
 				// if we are not in an installation context or if the pack is not available in the local directory
 				if (Language::getIdByIso($attributes['iso_code']) && !$install_mode)
 					continue;
-				$errors = Language::downloadAndInstallLanguagePack($attributes['iso_code'], $attributes['version']);
+				$errors = Language::downloadAndInstallLanguagePack($attributes['iso_code'], $attributes['version'], $attributes);
 				if ($errors !== true && is_array($errors))
 					$this->_errors = array_merge($this->_errors, $errors);
 			}

classes/ObjectModel.php

@@ -633,7 +633,7 @@ abstract class ObjectModelCore
 				$shop_exists = ObjectModel::$db->getValue('SELECT '.$this->def['primary'].' FROM '._DB_PREFIX_.$this->def['table'].'_shop WHERE '.$where);
 				if ($shop_exists)
 					$result &= ObjectModel::$db->update($this->def['table'].'_shop', $fields, $where, 0, $null_values);
-				else if (Shop::getContext() == Shop::CONTEXT_SHOP)
+				elseif (Shop::getContext() == Shop::CONTEXT_SHOP)
 					$result &= ObjectModel::$db->insert($this->def['table'].'_shop', $all_fields, $null_values);
 			}
 		}
@@ -1277,6 +1277,11 @@ abstract class ObjectModelCore
 	{
 		return Shop::isTableAssociated($this->def['table']) || !empty($this->def['multilang_shop']);
 	}
+	
+	public function isMultiShopField($field)
+	{
+		return (isset($this->def['fields'][$field]) && isset($this->def['fields'][$field]['shop']) && $this->def['fields'][$field]['shop']);
+	}
 
 	public function isLangMultishop()
 	{

classes/Product.php

@@ -394,6 +394,7 @@ class ProductCore extends ObjectModel
 				'resource' => 'product_feature',
 				'fields' => array(
 					'id' => array('required' => true),
+					'custom' => array('required' => false),
 					'id_feature_value' => array(
 						'required' => true,
 						'xlink_resource' => 'product_feature_values'
@@ -3214,8 +3215,9 @@ class ProductCore extends ObjectModel
 			return array();
 		if (!array_key_exists($id_product, self::$_cacheFeatures))
 			self::$_cacheFeatures[$id_product] = Db::getInstance(_PS_USE_SQL_SLAVE_)->executeS('
-				SELECT id_feature, id_product, id_feature_value
+				SELECT fp.id_feature, fp.id_product, fp.id_feature_value, custom
-				FROM `'._DB_PREFIX_.'feature_product`
+				FROM `'._DB_PREFIX_.'feature_product` fp
+				LEFT JOIN `'._DB_PREFIX_.'feature_value` fv ON (fp.id_feature_value = fv.id_feature_value)
 				WHERE `id_product` = '.(int)$id_product
 			);
 		return self::$_cacheFeatures[$id_product];
@@ -3263,6 +3265,7 @@ class ProductCore extends ObjectModel
 		LEFT JOIN '._DB_PREFIX_.'feature_lang fl ON (fl.id_feature = pf.id_feature AND fl.id_lang = '.(int)$id_lang.')
 		LEFT JOIN '._DB_PREFIX_.'feature_value_lang fvl ON (fvl.id_feature_value = pf.id_feature_value AND fvl.id_lang = '.(int)$id_lang.')
 		LEFT JOIN '._DB_PREFIX_.'feature f ON (f.id_feature = pf.id_feature)
+		'.Shop::addSqlAssociation('feature', 'f').'
 		WHERE `id_product` IN ('.implode($product_implode, ',').')
 		ORDER BY f.position ASC');
 
@@ -3873,6 +3876,7 @@ class ProductCore extends ObjectModel
 				LEFT JOIN '._DB_PREFIX_.'feature_lang fl ON (fl.id_feature = pf.id_feature AND fl.id_lang = '.(int)$id_lang.')
 				LEFT JOIN '._DB_PREFIX_.'feature_value_lang fvl ON (fvl.id_feature_value = pf.id_feature_value AND fvl.id_lang = '.(int)$id_lang.')
 				LEFT JOIN '._DB_PREFIX_.'feature f ON (f.id_feature = pf.id_feature AND fl.id_lang = '.(int)$id_lang.')
+				'.Shop::addSqlAssociation('feature', 'f').'
 				WHERE pf.id_product = '.(int)$id_product.'
 				ORDER BY f.position ASC'
 			);
@@ -4425,12 +4429,51 @@ class ProductCore extends ObjectModel
 	*/
 	public function setWsProductFeatures($product_features)
 	{
-		$this->deleteProductFeatures();
+	
-		foreach ($product_features as $product_feature)
+	$db_features = Db::getInstance()->executeS('
-			$this->addFeaturesToDB($product_feature['id'], $product_feature['id_feature_value']);
+							SELECT p.*, f.`custom`
-		return true;
+							FROM `'._DB_PREFIX_.'feature_product` p
-	}
+							LEFT JOIN `'._DB_PREFIX_.'feature_value` f ON (f.`id_feature_value` = p.`id_feature_value`)
+							WHERE `id_product` = '.(int)$this->id
+						);
 
+
+		$pfa = array();
+		foreach ($product_features as $product_feature)
+			$pfa[$product_feature['id']] = 1;
+
+		foreach ($db_features as $db_feature)
+		{
+			// test if feature should stay in db (if it is part of updated product)
+			if (!isset($pfa[$db_feature['id_feature']]))
+			{
+					// delete only custom features
+					if ($db_feature['custom'])
+					{
+						Db::getInstance()->execute('
+							DELETE FROM `'._DB_PREFIX_.'feature_value_lang`
+							WHERE `id_feature_value` = '.(int)$db_feature['id_feature_value']
+						);
+						Db::getInstance()->execute('
+							DELETE FROM `'._DB_PREFIX_.'feature_value`
+							WHERE `id_feature_value` = '.(int)$db_feature['id_feature_value']
+						);
+
+					}
+			}
+		}
+
+		Db::getInstance()->execute('
+			DELETE FROM `'._DB_PREFIX_.'feature_product`
+			WHERE `id_product` = '.(int)$this->id
+		);
+
+ 		foreach ($product_features as $product_feature)
+ 			$this->addFeaturesToDB($product_feature['id'], $product_feature['id_feature_value'], $product_feature['custom']);
+
+ 		return true;
+	}
+	/*
 	/**
 	* Webservice getter : get virtual field default combination
 	*

classes/Tools.php

@@ -1855,7 +1855,7 @@ exit;
 	{
 		$backtrace = debug_backtrace();
 		$callee = next($backtrace);
-		$error = 'Parameter <b>'.$parameter.'</b> in function <b>'.(isset($callee['function']) ? $callee['function'] : '').'()</b> is deprecated in <b>'.$callee['file'].'</b> on line <b>'.$callee['Line'].'</b><br />';
+		$error = 'Parameter <b>'.$parameter.'</b> in function <b>'.(isset($callee['function']) ? $callee['function'] : '').'()</b> is deprecated in <b>'.$callee['file'].'</b> on line <b>'.(isset($callee['Line']) ? $callee['Line'] : '').'</b><br />';
 		$message = 'The parameter '.$parameter.' in function '.$callee['function'].' (Line '.$callee['Line'].') is deprecated and will be removed in the next major version.';
 		$class = isset($callee['class']) ? $callee['class'] : null;
 

classes/order/Order.php

@@ -240,6 +240,8 @@ class OrderCore extends ObjectModel
 					'product_quantity' => array('required' => true),
 					'product_name' => array('setter' => false),
 					'product_price' => array('setter' => false),
+					'unit_price_tax_incl' => array('setter' => false),
+					'unit_price_tax_excl' => array('setter' => false),
 				)),
 		),
 
@@ -1287,7 +1289,7 @@ class OrderCore extends ObjectModel
 
 	public function getWsOrderRows()
 	{
-		$query = 'SELECT id_order_detail as `id`, `product_id`, `product_price`, `id_order`, `product_attribute_id`, `product_quantity`, `product_name`
+		$query = 'SELECT id_order_detail as `id`, `product_id`, `product_price`, `id_order`, `product_attribute_id`, `product_quantity`, `product_name`, `unit_price_tax_incl`, `unit_price_tax_excl`
 		FROM `'._DB_PREFIX_.'order_detail`
 		WHERE id_order = '.(int)$this->id;
 		$result = Db::getInstance()->executeS($query);

classes/webservice/WebserviceRequest.php

@@ -1184,7 +1184,14 @@ class WebserviceRequestCore
 					$sql_sort .= 'main_i18n.`'.pSQL($this->resourceConfiguration['fields'][$fieldName]['sqlId']).'` '.$direction.', ';// ORDER BY main_i18n.`field` ASC|DESC
 				}
 				else
-					$sql_sort .= (isset($this->resourceConfiguration['retrieveData']['tableAlias']) ? $this->resourceConfiguration['retrieveData']['tableAlias'].'.' : '').'`'.pSQL($this->resourceConfiguration['fields'][$fieldName]['sqlId']).'` '.$direction.', ';// ORDER BY `field` ASC|DESC
+				{
+					$object = new $this->resourceConfiguration['retrieveData']['className']();
+					if ($object->isMultiShopField($this->resourceConfiguration['fields'][$fieldName]['sqlId']))
+						$table_alias = 'multi_shop_'.$this->resourceConfiguration['retrieveData']['table'];
+					else
+						$table_alias = '';
+					$sql_sort .= (isset($this->resourceConfiguration['retrieveData']['tableAlias']) ? '`'.bqSQL($this->resourceConfiguration['retrieveData']['tableAlias']).'`.' : '`'.bqSQL($table_alias).'`.').'`'.pSQL($this->resourceConfiguration['fields'][$fieldName]['sqlId']).'` '.$direction.', ';// ORDER BY `field` ASC|DESC
+				}
 			}
 			$sql_sort = rtrim($sql_sort, ', ')."\n";
 		}
@@ -1218,6 +1225,11 @@ class WebserviceRequestCore
 	{
 		$objects = array();
 		$filters = $this->manageFilters();
+
+		/* If we only need to display the synopsis, analyzing the first row is sufficient */
+		if (isset($this->urlFragments['schema']) && $this->urlFragments['schema'] == 'synopsis')
+			$filters = array('sql_join' => '', 'sql_filter' => '', 'sql_sort' => '', 'sql_limit' => ' LIMIT 1');
+			
 		$this->resourceConfiguration['retrieveData']['params'][] = $filters['sql_join'];
 		$this->resourceConfiguration['retrieveData']['params'][] = $filters['sql_filter'];
 		$this->resourceConfiguration['retrieveData']['params'][] = $filters['sql_sort'];

config/config.inc.php

@@ -53,9 +53,6 @@ require_once(dirname(__FILE__).'/settings.inc.php');
 
 require_once(dirname(__FILE__).'/autoload.php');
 
-if (Tools::isPHPCLI())
-	Tools::argvToGET($argc, $argv);
-
 if (_PS_DEBUG_PROFILING_)
 {
 	include_once(_PS_TOOL_DIR_.'profiling/Controller.php');
@@ -65,6 +62,9 @@ if (_PS_DEBUG_PROFILING_)
 	include_once(_PS_TOOL_DIR_.'profiling/Tools.php');
 }
 
+if (Tools::isPHPCLI())
+	Tools::argvToGET($argc, $argv);
+
 /* Redefine REQUEST_URI if empty (on some webservers...) */
 if (!isset($_SERVER['REQUEST_URI']) || empty($_SERVER['REQUEST_URI']))
 {

config/smartyadmin.config.inc.php

@@ -57,7 +57,14 @@ function smartyTranslate($params, &$smarty)
 	// If the tpl is used by a Controller
 	else
 	{
-		// Split by \ and / to get the folder tree for the file
+		if (isset(Context::getContext()->controller))
+		{
+			$class_name = get_class(Context::getContext()->controller);
+			$class = substr($class_name, 0, strpos(Tools::strtolower($class_name), 'controller'));
+		}
+		else
+		{
+	// Split by \ and / to get the folder tree for the file
 		$folder_tree = preg_split('#[/\\\]#', $filename);
 		$key = array_search('controllers', $folder_tree);
 
@@ -69,8 +76,8 @@ function smartyTranslate($params, &$smarty)
 			$class = 'Admin'.Tools::toCamelCase($folder_tree[0], true);
 		else
 			$class = null;
+		}
 	}
 
 	return Translate::getAdminTranslation($params['s'], $class, $addslashes, $htmlentities, $sprintf);
-}
+}
-

controllers/admin/AdminAddressesController.php

@@ -444,4 +444,41 @@ class AdminAddressesControllerCore extends AdminController
 		}
 		die;
 	}
+
+	/**
+	 * Object Delete
+	 */
+	public function processDelete()
+	{
+		if (Validate::isLoadedObject($object = $this->loadObject()))
+			if (!$object->isUsed())
+				$this->deleted = false;
+
+		return parent::processDelete();
+	}
+
+	/**
+	 * Delete multiple items
+	 *
+	 * @return boolean true if succcess
+	 */
+	protected function processBulkDelete()
+	{
+		if (is_array($this->boxes) && !empty($this->boxes))
+		{
+			$deleted = false;
+			foreach ($this->boxes as $id)
+			{
+				$to_delete = new Address((int)$id);
+				if ($to_delete->isUsed())
+				{
+					$deleted = true;
+					break;
+				}
+			}
+			$this->deleted = $deleted;
+		}
+
+		return parent::processBulkDelete();
+	}
 }

controllers/admin/AdminImagesController.php

@@ -53,7 +53,7 @@ class AdminImagesControllerCore extends AdminController
 		);
 		
 		// No need to display the old image system if the install has been made later than 2013-03-26
-		$this->display_move = (defined('_PS_CREATION_DATE_') && strtotime(_PS_CREATION_DATE_) > strtotime('2013-03-26')) ? false : true;
+		$this->display_move = (!Configuration::get('PS_LEGACY_IMAGES') && defined('_PS_CREATION_DATE_') && strtotime(_PS_CREATION_DATE_) > strtotime('2013-03-26')) ? false : true;
 
 		$this->fields_options = array(
 			'images' => array(
@@ -62,7 +62,7 @@ class AdminImagesControllerCore extends AdminController
 				'top' => '',
 				'bottom' => '',
 				'description' => $this->l('JPEG images have a small file size and standard quality. PNG images have a larger file size, a higher quality and support transparency. Note that in all cases the image files will have the .jpg extension.').'
-								  <br /><br />'.$this->l('WARNING: This feature may not be compatible with your theme, or with some of your modules. In particular, PNG mode is not compatible with the Watermark module. If you encounter any issues, turn it off by selecting "Use JPEG".'),
+					<br /><br />'.$this->l('WARNING: This feature may not be compatible with your theme, or with some of your modules. In particular, PNG mode is not compatible with the Watermark module. If you encounter any issues, turn it off by selecting "Use JPEG".'),
 				'fields' =>	array(
 					'PS_IMAGE_QUALITY' => array(
 						'title' => $this->l('Image quality'),

controllers/admin/AdminMetaController.php

@@ -529,6 +529,7 @@ class AdminMetaControllerCore extends AdminController
 			{
 				$this->url->domain = $value;
 				$this->url->update();
+				Configuration::updateGlobalValue('PS_SHOP_DOMAIN', $value);
 			}
 			else
 				$this->errors[] = Tools::displayError('This domain is not valid.');
@@ -546,6 +547,7 @@ class AdminMetaControllerCore extends AdminController
 			{
 				$this->url->domain_ssl = $value;
 				$this->url->update();
+				Configuration::updateGlobalValue('PS_SHOP_DOMAIN_SSL', $value);
 			}
 			else
 				$this->errors[] = Tools::displayError('The SSL domain is not valid.');

controllers/admin/AdminOrdersController.php

@@ -1970,8 +1970,8 @@ class AdminOrdersControllerCore extends AdminController
 	{
 		$res = true;
 
-		$order_detail = new OrderDetail(Tools::getValue('id_order_detail'));
+		$order_detail = new OrderDetail((int)Tools::getValue('id_order_detail'));
-		$order = new Order(Tools::getValue('id_order'));
+		$order = new Order((int)Tools::getValue('id_order'));
 
 		$this->doDeleteProductLineValidation($order_detail, $order);
 
@@ -1994,6 +1994,9 @@ class AdminOrdersControllerCore extends AdminController
 		$order->total_products_wt -= $order_detail->total_price_tax_incl;
 
 		$res &= $order->update();
+		
+		// Reinject quantity in stock
+		$this->reinjectQuantity($order_detail, $order_detail->product_quantity);
 
 		// Delete OrderDetail
 		$res &= $order_detail->delete();

controllers/admin/AdminProductsController.php

@@ -373,7 +373,7 @@ class AdminProductsControllerCore extends AdminController
 				$default_product = new Product((int)$this->object->id, false, null, (int)$this->object->id_shop_default);
 				$def = ObjectModel::getDefinition($this->object);
 				foreach ($def['fields'] as $field_name => $row)
-					$this->object->$field_name = $default_product->$field_name;
+					$this->object->$field_name = ObjectModel::formatValue($default_product->$field_name, $def['fields'][$field_name]['type']);
 			}
 			$this->object->loadStockData();
 		}
@@ -1802,6 +1802,29 @@ class AdminProductsControllerCore extends AdminController
 				if (Shop::isFeatureActive() && Shop::getContext() != Shop::CONTEXT_SHOP)
 					$object->setFieldsToUpdate((array)Tools::getValue('multishop_check'));
 
+				// Duplicate combinations if not associated to shop
+				if ($this->context->shop->getContext() == Shop::CONTEXT_SHOP && !$object->isAssociatedToShop())
+				{
+					$is_associated_to_shop = false;
+					$combinations = Product::getProductAttributesIds($object->id);
+					if ($combinations)
+					{
+						foreach ($combinations as $id_combination)
+						{
+							$combination = new Combination((int)$id_combination['id_product_attribute']);
+							$default_combination = new Combination((int)$id_combination['id_product_attribute'], null, (int)$this->object->id_shop_default);
+
+							$def = ObjectModel::getDefinition($default_combination);
+							foreach ($def['fields'] as $field_name => $row)
+								$combination->$field_name = ObjectModel::formatValue($default_combination->$field_name, $def['fields'][$field_name]['type']);
+
+							$combination->save();
+						}
+					}
+				}
+				else
+					$is_associated_to_shop = true;
+
 				if ($object->update())
 				{
 					if (in_array($this->context->shop->getContext(), array(Shop::CONTEXT_SHOP, Shop::CONTEXT_ALL)))
@@ -1892,7 +1915,15 @@ class AdminProductsControllerCore extends AdminController
 						$this->display = 'edit';
 				}
 				else
+				{
+					if (!$is_associated_to_shop && $combinations)
+						foreach ($combinations as $id_combination)
+						{
+							$combination = new Combination((int)$id_combination['id_product_attribute']);
+							$combination->delete();
+						}
 					$this->errors[] = Tools::displayError('An error occurred while updating an object.').' <b>'.$this->table.'</b> ('.Db::getInstance()->getMsgError().')';
+				}
 			}
 			else
 				$this->errors[] = Tools::displayError('An error occurred while updating an object.').' <b>'.$this->table.'</b> ('.Tools::displayError('The object cannot be loaded. ').')';

controllers/admin/AdminReturnController.php

@@ -136,7 +136,7 @@ class AdminReturnControllerCore extends AdminController
 		$this->tpl_form_vars = array(
 			'customer' => new Customer($this->object->id_customer),
 			'url_customer' => 'index.php?tab=AdminCustomers&id_customer='.(int)$this->object->id_customer.'&viewcustomer&token='.Tools::getAdminToken('AdminCustomers'.(int)(Tab::getIdFromClassName('AdminCustomers')).(int)$this->context->employee->id),
-			'text_order' => sprintf($this->l('Order #%1$d from %2$s'), $order->id, Tools::displayDate($order->date_upd, $order->id_lang)),
+			'text_order' => sprintf($this->l('Order #%1$d from %2$s'), $order->id, Tools::displayDate($order->date_upd)),
 			'url_order' => 'index.php?tab=AdminOrders&id_order='.(int)$order->id.'&vieworder&token='.Tools::getAdminToken('AdminOrders'.(int)Tab::getIdFromClassName('AdminOrders').(int)$this->context->employee->id),
 			'picture_folder' => _THEME_PROD_PIC_DIR_,
 			'type_file' => Product::CUSTOMIZE_FILE,

controllers/admin/AdminTrackingController.php

@@ -52,6 +52,9 @@ class AdminTrackingControllerCore extends AdminController
 
 	public function initContent()
 	{
+		if ($id_category = Tools::getValue('id_category') && Tools::getIsset('viewcategory'))
+			Tools::redirectAdmin($this->context->link->getAdminLink('AdminProducts').'&id_category='.(int)$id_category.'&viewcategory');
+
 		$this->_helper_list = new HelperList();
 		
 		if (!Configuration::get('PS_STOCK_MANAGEMENT'))

controllers/admin/AdminWarehousesController.php

@@ -424,7 +424,7 @@ class AdminWarehousesControllerCore extends AdminController
 		$address = new Address($object->id_address);
 		if (Validate::isLoadedObject($address))
 		{
-			$address->id_warehouse = $object->id_address;
+			$address->id_warehouse = (int)$object->id;
 			$address->save();
 		}
 

controllers/front/NewProductsController.php

@@ -47,6 +47,13 @@ class NewProductsControllerCore extends FrontController
 
 		$this->productSort();
 
+		// Override default configuration values: cause the new products page must display latest products first.
+		if (!Tools::getIsset('orderway') || !Tools::getIsset('orderby'))
+		{
+      $this->orderBy = 'date_add';
+      $this->orderWay = 'DESC';
+		}
+
 		$nbProducts = (int)Product::getNewProducts(
 			$this->context->language->id,
 			(isset($this->p) ? (int)($this->p) - 1 : null),

install-dev/classes/session.php

@@ -30,6 +30,8 @@
 class InstallSession
 {
 	protected static $_instance;
+	protected static $_cookie_mode = false;
+	protected static $_cookie = false;
 
 	public static function getInstance()
 	{
@@ -41,39 +43,71 @@ class InstallSession
 	public function __construct()
 	{
 		session_name('install_'.md5(__PS_BASE_URI__));
-		session_start();
+		if (!session_start() || (!isset($_SESSION['session_mode']) && (count($_POST) || count($_GET))))
+		{
+			InstallSession::$_cookie_mode = true;
+			InstallSession::$_cookie = new Cookie('ps_install', null, time() + 7200, null, true);
+		}
+		$_SESSION['session_mode'] = 'session';
 	}
 
 	public function clean()
 	{
-		foreach ($_SESSION as $k => $v)
+		if (InstallSession::$_cookie_mode)
-			unset($_SESSION[$k]);
+			InstallSession::$_cookie->logout();
+		else
+			foreach ($_SESSION as $k => $v)
+				unset($_SESSION[$k]);
 	}
 
 	public function &__get($varname)
 	{
-		if (isset($_SESSION[$varname]))
+		if (InstallSession::$_cookie_mode)
-			$ref = &$_SESSION[$varname];
+		{
+			$ref = InstallSession::$_cookie->{$varname};
+			if (0 === strncmp($ref, 'serialized_array:', strlen('serialized_array:')))
+				$ref = unserialize(substr($ref, strlen('serialized_array:')));
+		}
 		else
 		{
-			$null = null;
+			if (isset($_SESSION[$varname]))
-			$ref = &$null;
+				$ref = &$_SESSION[$varname];
+			else
+			{
+				$null = null;
+				$ref = &$null;
+			}
 		}
 		return $ref;
 	}
 
 	public function __set($varname, $value)
 	{
-		$_SESSION[$varname] = $value;
+		if (InstallSession::$_cookie_mode)
+		{
+			if ($varname == 'xml_loader_ids')
+				return;
+			if (is_array($value))
+				$value = 'serialized_array:'.serialize($value);
+			InstallSession::$_cookie->{$varname} = $value;
+		}
+		else
+			$_SESSION[$varname] = $value;
 	}
 
 	public function __isset($varname)
 	{
-		return isset($_SESSION[$varname]);
+		if (InstallSession::$_cookie_mode)
+			return isset(InstallSession::$_cookie->{$varname});
+		else
+			return isset($_SESSION[$varname]);
 	}
 
 	public function __unset($varname)
 	{
-		unset($_SESSION[$varname]);
+		if (InstallSession::$_cookie_mode)
+			unset(InstallSession::$_cookie->{$varname});
+		else
+			unset($_SESSION[$varname]);
 	}
 }

install-dev/controllers/http/process.php

@@ -78,7 +78,7 @@ class InstallControllerHttpProcess extends InstallControllerHttp
 	public function process()
 	{
 		if (file_exists(_PS_ROOT_DIR_.'/'.self::SETTINGS_FILE))
-			@require_once _PS_ROOT_DIR_.'/'.self::SETTINGS_FILE;
+			require_once _PS_ROOT_DIR_.'/'.self::SETTINGS_FILE;
 
 		if (!$this->session->process_validated)
 			$this->session->process_validated = array();

install-dev/langs/pl/language.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <language>
-	<name><![CDATA[Polski(Polish)]]></name>
+	<name><![CDATA[Polski (Polish)]]></name>
 	<language_code>pl</language_code>
 	<date_format_lite>m/j/Y</date_format_lite>
 	<date_format_full>m/j/Y H:i:s</date_format_full>

install-dev/theme/js/process.js

@@ -20,8 +20,8 @@ function start_install()
 	$('.stepList li:last-child').removeClass('ok').removeClass('ko');
 	process_pixel = parseInt($('#progress_bar .total').css('width')) / process_steps.length;
 	$('#tabs li a').each(function() {
-		 this.rel=$(this).attr('href');
+		 this.rel = $(this).attr('href');
-		 this.href='#';
+		 this.href = '#';
 	});
 	process_install();
 }
@@ -31,11 +31,11 @@ function process_install(step)
 	if (!step)
 		step = process_steps[0];
 
-	$('.installing').hide().html(step.lang+' ...').fadeIn('slow');
+	$('.installing').hide().html(step.lang + ' ...').fadeIn('slow');
 
 	$.ajax({
 		url: 'index.php',
-		data: step.key+'=true',
+		data: step.key + '=true',
 		dataType: 'json',
 		cache: false,
 		success: function(json)
@@ -51,10 +51,7 @@ function process_install(step)
 					$('#progress_bar .total span').html('100%');
 
 					// Installation finished
-					setTimeout(function()
+					setTimeout(function(){install_success();}, 700);
-					{
-						install_success();
-					}, 700)
 				}
 				else
 				{

install-dev/theme/views/header.phtml

@@ -83,4 +83,7 @@
 				<li <?php if ($this->isStepFinished($step)): ?>class="ok"<?php endif; ?>><?php echo $this->l('menu_'.$this->step) ?></li>
 			<?php endforeach; ?>
 		</ul>
-	</div>
+	</div>
+	<noscript>
+		<h3 class="errorBlock" style="margin-bottom:10px"><?php echo $this->l('To install PrestaShop, you need to have JavaScript enabled in your browser.') ?></h3>
+	</noscript>

install-dev/upgrade/php/fix_download_product_feature_active.php

@@ -0,0 +1,31 @@
+<?php
+/*
+* 2007-2013 PrestaShop
+*
+* NOTICE OF LICENSE
+*
+* This source file is subject to the Open Software License (OSL 3.0)
+* that is bundled with this package in the file LICENSE.txt.
+* It is also available through the world-wide-web at this URL:
+* http://opensource.org/licenses/osl-3.0.php
+* If you did not receive a copy of the license and are unable to
+* obtain it through the world-wide-web, please send an email
+* to license@prestashop.com so we can send you a copy immediately.
+*
+* DISCLAIMER
+*
+* Do not edit or add to this file if you wish to upgrade PrestaShop to newer
+* versions in the future. If you wish to customize PrestaShop for your
+* needs please refer to http://www.prestashop.com for more information.
+*
+*  @author PrestaShop SA <contact@prestashop.com>
+*  @copyright  2007-2013 PrestaShop SA
+*  @license    http://opensource.org/licenses/osl-3.0.php  Open Software License (OSL 3.0)
+*  International Registered Trademark & Property of PrestaShop SA
+*/
+
+function fix_download_product_feature_active()
+{
+	if (Db::getInstance()->getValue('SELECT COUNT(id_product_download) FROM `'._DB_PREFIX_.'product_download` WHERE `active` = 1 ;') > 0)
+		Configuration::updateGlobaleValue('PS_VIRTUAL_PROD_FEATURE_ACTIVE');
+}

install-dev/upgrade/sql/1.5.5.0.sql

@@ -14,3 +14,6 @@ CHANGE `module_name` `module_name` VARCHAR(64) NULL DEFAULT NULL;
 /* PHP:add_module_to_hook(blocksupplier, actionObjectSupplierDeleteAfter); */;
 /* PHP:add_module_to_hook(blocksupplier, actionObjectSupplierAddAfter); */;
 /* PHP:add_module_to_hook(blocksupplier, actionObjectSupplierUpdateAfter); */;
+/* PHP:fix_download_product_feature_active(); */;
+
+

mails/en/download-product.tpl

@@ -1,7 +1,7 @@
 <ul>
 {foreach from=$virtualProducts item=product}
 	<li>
-		<a href="{$product.link}">{$product.name}</a>
+		<a href="{$product.link|escape:'html'}">{$product.name}</a>
 		{if isset($product.deadline)}
 			expires on {$product.deadline}
 		{/if}

modules/bankwire/views/templates/front/payment_execution.tpl

@@ -36,7 +36,7 @@
 {else}
 
 <h3>{l s='Bank-wire payment.' mod='bankwire'}</h3>
-<form action="{$link->getModuleLink('bankwire', 'validation', [], true)}" method="post">
+<form action="{$link->getModuleLink('bankwire', 'validation', [], true)|escape:'html'}" method="post">
 <p>
 	<img src="{$this_path_bw}bankwire.jpg" alt="{l s='Bank wire' mod='bankwire'}" width="86" height="49" style="float:left; margin: 0px 10px 5px 0px;" />
 	{l s='You have chosen to pay by bank wire.' mod='bankwire'}
@@ -73,7 +73,7 @@
 </p>
 <p class="cart_navigation">
 	<input type="submit" name="submit" value="{l s='Place my order' mod='bankwire'}" class="exclusive_large" />
-	<a href="{$link->getPageLink('order', true, NULL, "step=3")}" class="button_large">{l s='Other payment methods' mod='bankwire'}</a>
+	<a href="{$link->getPageLink('order', true, NULL, "step=3")|escape:'html'}" class="button_large">{l s='Other payment methods' mod='bankwire'}</a>
 </p>
 </form>
 {/if}

modules/bankwire/views/templates/hook/payment.tpl

@@ -24,7 +24,7 @@
 *}
 
 <p class="payment_module">
-	<a href="{$link->getModuleLink('bankwire', 'payment')}" title="{l s='Pay by bank wire' mod='bankwire'}">
+	<a href="{$link->getModuleLink('bankwire', 'payment')|escape:'html'}" title="{l s='Pay by bank wire' mod='bankwire'}">
 		<img src="{$this_path_bw}bankwire.jpg" alt="{l s='Pay by bank wire' mod='bankwire'}" width="86" height="49"/>
 		{l s='Pay by bank wire (order process will be longer)' mod='bankwire'}
 	</a>

modules/bankwire/views/templates/hook/payment_return.tpl

@@ -37,11 +37,11 @@
 			<br /><br />- {l s='Do not forget to insert your order reference %s in the subject of your bank wire.' sprintf=$reference mod='bankwire'}
 		{/if}		<br /><br />{l s='An email has been sent with this information.' mod='bankwire'}
 		<br /><br /> <strong>{l s='Your order will be sent as soon as we receive payment.' mod='bankwire'}</strong>
-		<br /><br />{l s='If you have questions, comments or concerns, please contact our' mod='bankwire'} <a href="{$link->getPageLink('contact', true)}">{l s='expert customer support team. ' mod='bankwire'}</a>.
+		<br /><br />{l s='If you have questions, comments or concerns, please contact our' mod='bankwire'} <a href="{$link->getPageLink('contact', true)|escape:'html'}">{l s='expert customer support team. ' mod='bankwire'}</a>.
 	</p>
 {else}
 	<p class="warning">
 		{l s='We noticed a problem with your order. If you think this is an error, feel free to contact our' mod='bankwire'} 
-		<a href="{$link->getPageLink('contact', true)}">{l s='expert customer support team. ' mod='bankwire'}</a>.
+		<a href="{$link->getPageLink('contact', true)|escape:'html'}">{l s='expert customer support team. ' mod='bankwire'}</a>.
 	</p>
 {/if}

modules/blockbestsellers/blockbestsellers-home.tpl

@@ -36,17 +36,17 @@
 			<ul style="height:{$ulHeight}px;">
 			{foreach from=$best_sellers item=product name=myLoop}
 				<li style="border-bottom:0" class="ajax_block_product {if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if} {if $smarty.foreach.myLoop.iteration%$nbItemsPerLine == 0}last_item_of_line{elseif $smarty.foreach.myLoop.iteration%$nbItemsPerLine == 1}clear{/if} {if $smarty.foreach.myLoop.iteration > ($smarty.foreach.myLoop.total - ($smarty.foreach.myLoop.total % $nbItemsPerLine))}last_line{/if}">
-					<h5 class="s_title_block"><a href="{$product.link}" title="{$product.name|truncate:32:'...'|escape:'htmlall':'UTF-8'}">{$product.name|truncate:27:'...'|escape:'htmlall':'UTF-8'}</a></h5>
+					<h5 class="s_title_block"><a href="{$product.link|escape:'html'}" title="{$product.name|truncate:32:'...'|escape:'htmlall':'UTF-8'}">{$product.name|truncate:27:'...'|escape:'htmlall':'UTF-8'}</a></h5>
-					<div class="product_desc"><a href="{$product.link}" title="{l s='More' mod='blockbestsellers'}">{$product.description_short|strip_tags|truncate:130:'...'}</a></div>
+					<div class="product_desc"><a href="{$product.link|escape:'html'}" title="{l s='More' mod='blockbestsellers'}">{$product.description_short|strip_tags|truncate:130:'...'}</a></div>
-					<a href="{$product.link}" title="{$product.name|escape:html:'UTF-8'}" class="product_image"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'home_default')}" height="{$homeSize.height}" width="{$homeSize.width}" alt="{$product.name|escape:html:'UTF-8'}" /></a>
+					<a href="{$product.link|escape:'html'}" title="{$product.name|escape:html:'UTF-8'}" class="product_image"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'home_default')|escape:'html'}" height="{$homeSize.height}" width="{$homeSize.width}" alt="{$product.name|escape:html:'UTF-8'}" /></a>
 					<div>
 						{if !$PS_CATALOG_MODE}<p class="price_container"><span class="price">{$product.price}</span></p>{else}<div style="height:21px;"></div>{/if}			
-						<a class="button" href="{$product.link}" title="{l s='View' mod='blockbestsellers'}">{l s='View' mod='blockbestsellers'}</a>
+						<a class="button" href="{$product.link|escape:'html'}" title="{l s='View' mod='blockbestsellers'}">{l s='View' mod='blockbestsellers'}</a>
 					</div>
 				</li>
 			{/foreach}
 			</ul>
-			<p class="clearfix" style="padding: 5px;"><a style="float:right;" href="{$link->getPageLink('best-sales')}" title="{l s='All best sellers' mod='blockbestsellers'}" class="button_large">{l s='All best sellers' mod='blockbestsellers'}</a></p>
+			<p class="clearfix" style="padding: 5px;"><a style="float:right;" href="{$link->getPageLink('best-sales')|escape:'html'}" title="{l s='All best sellers' mod='blockbestsellers'}" class="button_large">{l s='All best sellers' mod='blockbestsellers'}</a></p>
 		</div>
 	{else}
 		<p>{l s='No best sellers' mod='blockbestsellers'}</p>

modules/blockbestsellers/blockbestsellers.tpl

@@ -26,25 +26,25 @@
 
 <!-- MODULE Block best sellers -->
 <div id="best-sellers_block_right" class="block products_block">
-	<h4 class="title_block"><a href="{$link->getPageLink('best-sales')}" title="{l s='View a top sellers products' mod='blockbestsellers'}">{l s='Top sellers' mod='blockbestsellers'}</a></h4>
+	<h4 class="title_block"><a href="{$link->getPageLink('best-sales')|escape:'html'}" title="{l s='View a top sellers products' mod='blockbestsellers'}">{l s='Top sellers' mod='blockbestsellers'}</a></h4>
 	<div class="block_content">
 	{if $best_sellers|@count > 0}
 		<ul class="product_images">
 			{foreach from=$best_sellers item=product name=myLoop}
 			<li class="{if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if} clearfix">
-				<a href="{$product.link}" title="{$product.legend|escape:'htmlall':'UTF-8'}" class="content_img clearfix">
+				<a href="{$product.link|escape:'html'}" title="{$product.legend|escape:'htmlall':'UTF-8'}" class="content_img clearfix">
 					<span class="number">{$smarty.foreach.myLoop.iteration}</span>
-					<img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'small_default')}" height="{$smallSize.height}" width="{$smallSize.width}" alt="{$product.legend|escape:'htmlall':'UTF-8'}" />
+					<img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'small_default')|escape:'html'}" height="{$smallSize.height}" width="{$smallSize.width}" alt="{$product.legend|escape:'htmlall':'UTF-8'}" />
 				
 				</a>
-				<p><a href="{$product.link}" title="{$product.legend|escape:'htmlall':'UTF-8'}">
+				<p><a href="{$product.link|escape:'html'}" title="{$product.legend|escape:'htmlall':'UTF-8'}">
 					{$product.name|strip_tags:'UTF-8'|escape:'htmlall':'UTF-8'}<br />
 					<span class="price">{$product.price}</span>
 				</a></p>
 			</li>
 		{/foreach}
 		</ul>
-		<p class="lnk"><a href="{$link->getPageLink('best-sales')}" title="{l s='All best sellers' mod='blockbestsellers'}" class="button_large">&raquo; {l s='All best sellers' mod='blockbestsellers'}</a></p>
+		<p class="lnk"><a href="{$link->getPageLink('best-sales')|escape:'html'}" title="{l s='All best sellers' mod='blockbestsellers'}" class="button_large">&raquo; {l s='All best sellers' mod='blockbestsellers'}</a></p>
 	{else}
 		<p>{l s='No best sellers at this time' mod='blockbestsellers'}</p>
 	{/if}

modules/blockcart/blockcart-json.tpl

@@ -83,7 +83,7 @@
 		"description":     "{$discount.description|addslashes|replace:'\\\'':'\''}",
 		"nameDescription": "{$discount.name|cat:' : '|cat:$discount.description|truncate:18:'...'|addslashes|replace:'\\\'':'\''}",
 		"code":            "{$discount.code}",
-		"link":            "{$link->getPageLink("$order_process", true, NULL, "deleteDiscount={$discount.id_discount}")}",
+		"link":            "{$link->getPageLink("$order_process", true, NULL, "deleteDiscount={$discount.id_discount}")|escape:'html'}",
 		"price":           "{if $priceDisplay == 1}{convertPrice|html_entity_decode:2:'UTF-8' price=$discount.value_tax_exc}{else}{convertPrice|html_entity_decode:2:'UTF-8' price=$discount.value_real}{/if}",
 		"price_float":     "{if $priceDisplay == 1}{$discount.value_tax_exc}{else}{$discount.value_real}{/if}"
 	{rdelim}

modules/blockcart/blockcart.tpl

@@ -45,7 +45,7 @@ var generated_date = {$smarty.now|intval};
 <!-- MODULE Block cart -->
 <div id="cart_block" class="block exclusive">
 	<h4 class="title_block">
-		<a href="{$link->getPageLink("$order_process", true)}" title="{l s='View my shopping cart' mod='blockcart'}" rel="nofollow">{l s='Cart' mod='blockcart'}</a>
+		<a href="{$link->getPageLink("$order_process", true)|escape:'html'}" title="{l s='View my shopping cart' mod='blockcart'}" rel="nofollow">{l s='Cart' mod='blockcart'}</a>
 		{if $ajax_allowed}
 		<span id="block_cart_expand" {if isset($colapseExpandStatus) && $colapseExpandStatus eq 'expanded' || !isset($colapseExpandStatus)}class="hidden"{/if}>&nbsp;</span>
 		<span id="block_cart_collapse" {if isset($colapseExpandStatus) && $colapseExpandStatus eq 'collapsed'}class="hidden"{/if}>&nbsp;</span>
@@ -77,9 +77,9 @@ var generated_date = {$smarty.now|intval};
 			{assign var='productAttributeId' value=$product.id_product_attribute}
 			<dt id="cart_block_product_{$product.id_product}_{if $product.id_product_attribute}{$product.id_product_attribute}{else}0{/if}_{if $product.id_address_delivery}{$product.id_address_delivery}{else}0{/if}" class="{if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if}">
 				<span class="quantity-formated"><span class="quantity">{$product.cart_quantity}</span>x</span>
-				<a class="cart_block_product_name" href="{$link->getProductLink($product, $product.link_rewrite, $product.category, null, null, $product.id_shop, $product.id_product_attribute)}" title="{$product.name|escape:html:'UTF-8'}">
+				<a class="cart_block_product_name" href="{$link->getProductLink($product, $product.link_rewrite, $product.category, null, null, $product.id_shop, $product.id_product_attribute)|escape:'html'}" title="{$product.name|escape:html:'UTF-8'}">
 				{$product.name|truncate:13:'...'|escape:html:'UTF-8'}</a>
-				<span class="remove_link">{if !isset($customizedDatas.$productId.$productAttributeId) && (!isset($product.is_gift) || !$product.is_gift)}<a rel="nofollow" class="ajax_cart_block_remove_link" href="{$link->getPageLink('cart', true, NULL, "delete=1&amp;id_product={$product.id_product}&amp;ipa={$product.id_product_attribute}&amp;id_address_delivery={$product.id_address_delivery}&amp;token={$static_token}", true)}" title="{l s='Please remove this product from my cart.' mod='blockcart'}">&nbsp;</a>{/if}</span>
+				<span class="remove_link">{if !isset($customizedDatas.$productId.$productAttributeId) && (!isset($product.is_gift) || !$product.is_gift)}<a rel="nofollow" class="ajax_cart_block_remove_link" href="{$link->getPageLink('cart', true, NULL, "delete=1&amp;id_product={$product.id_product}&amp;ipa={$product.id_product_attribute}&amp;id_address_delivery={$product.id_address_delivery}&amp;token={$static_token}", true)|escape:'html'}" title="{l s='Please remove this product from my cart.' mod='blockcart'}">&nbsp;</a>{/if}</span>
 				<span class="price">
 					{if !isset($product.is_gift) || !$product.is_gift}
 						{if $priceDisplay == $smarty.const.PS_TAX_EXC}{displayWtPrice p="`$product.total`"}{else}{displayWtPrice p="`$product.total_wt`"}{/if}
@@ -90,7 +90,7 @@ var generated_date = {$smarty.now|intval};
 			</dt>
 			{if isset($product.attributes_small)}
 			<dd id="cart_block_combination_of_{$product.id_product}{if $product.id_product_attribute}_{$product.id_product_attribute}{/if}_{$product.id_address_delivery|intval}" class="{if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if}">
-				<a href="{$link->getProductLink($product, $product.link_rewrite, $product.category, null, null, $product.id_shop, $product.id_product_attribute)}" title="{l s='Product detail' mod='blockcart'}">{$product.attributes_small}</a>
+				<a href="{$link->getProductLink($product, $product.link_rewrite, $product.category, null, null, $product.id_shop, $product.id_product_attribute)|escape:'html'}" title="{l s='Product detail' mod='blockcart'}">{$product.attributes_small}</a>
 			{/if}
 
 			<!-- Customizable datas -->
@@ -99,7 +99,7 @@ var generated_date = {$smarty.now|intval};
 				<ul class="cart_block_customizations" id="customization_{$productId}_{$productAttributeId}">
 					{foreach from=$customizedDatas.$productId.$productAttributeId[$product.id_address_delivery] key='id_customization' item='customization' name='customizations'}
 						<li name="customization">
-							<div class="deleteCustomizableProduct" id="deleteCustomizableProduct_{$id_customization|intval}_{$product.id_product|intval}_{$product.id_product_attribute|intval}_{$product.id_address_delivery|intval}"><a class="ajax_cart_block_remove_link" href="{$link->getPageLink('cart', true, NULL, "delete=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_customization={$id_customization}&amp;token={$static_token}", true)}" rel="nofollow"> </a></div>
+							<div class="deleteCustomizableProduct" id="deleteCustomizableProduct_{$id_customization|intval}_{$product.id_product|intval}_{$product.id_product_attribute|intval}_{$product.id_address_delivery|intval}"><a class="ajax_cart_block_remove_link" href="{$link->getPageLink('cart', true, NULL, "delete=1&amp;id_product={$product.id_product|intval}&amp;ipa={$product.id_product_attribute|intval}&amp;id_customization={$id_customization}&amp;token={$static_token}", true)|escape:'html'}" rel="nofollow"> </a></div>
 							<span class="quantity-formated"><span class="quantity">{$customization.quantity}</span>x</span>{if isset($customization.datas.$CUSTOMIZE_TEXTFIELD.0)}
 							{$customization.datas.$CUSTOMIZE_TEXTFIELD.0.value|replace:"<br />":" "|truncate:28:'...'|escape:html:'UTF-8'}
 							{else}
@@ -118,22 +118,20 @@ var generated_date = {$smarty.now|intval};
 	{/if}
 		<p {if $products}class="hidden"{/if} id="cart_block_no_products">{l s='No products' mod='blockcart'}</p>
 		<table id="vouchers"{if $discounts|@count == 0} style="display:none;"{/if}>
-			<tbody>
+			{foreach from=$discounts item=discount}
-					{foreach from=$discounts item=discount}
+				{if $discount.value_real > 0}
-						{if $discount.value_real > 0}
+				<tr class="bloc_cart_voucher" id="bloc_cart_voucher_{$discount.id_discount}">
-						<tr class="bloc_cart_voucher" id="bloc_cart_voucher_{$discount.id_discount}">
+					<td class="quantity">1x</td>
-							<td class="quantity">1x</td>
+					<td class="name" title="{$discount.description}">{$discount.name|cat:' : '|cat:$discount.description|truncate:18:'...'|escape:'htmlall':'UTF-8'}</td>
-							<td class="name" title="{$discount.description}">{$discount.name|cat:' : '|cat:$discount.description|truncate:18:'...'|escape:'htmlall':'UTF-8'}</td>
+					<td class="price">-{if $priceDisplay == 1}{convertPrice price=$discount.value_tax_exc}{else}{convertPrice price=$discount.value_real}{/if}</td>
-							<td class="price">-{if $priceDisplay == 1}{convertPrice price=$discount.value_tax_exc}{else}{convertPrice price=$discount.value_real}{/if}</td>
+					<td class="delete">
-							<td class="delete">
+						{if strlen($discount.code)}
-								{if strlen($discount.code)}
+							<a class="delete_voucher" href="{$link->getPageLink('$order_process', true)}?deleteDiscount={$discount.id_discount}" title="{l s='Delete' mod='blockcart'}" rel="nofollow"><img src="{$img_dir}icon/delete.gif" alt="{l s='Delete' mod='blockcart'}" class="icon" /></a>
-									<a class="delete_voucher" href="{$link->getPageLink('$order_process', true)}?deleteDiscount={$discount.id_discount}" title="{l s='Delete' mod='blockcart'}" rel="nofollow"><img src="{$img_dir}icon/delete.gif" alt="{l s='Delete' mod='blockcart'}" class="icon" /></a>
-								{/if}
-							</td>
-						</tr>
 						{/if}
-					{/foreach}					
+					</td>
-			</tbody>
+				</tr>
+				{/if}
+			{/foreach}					
 		</table>
 		<p id="cart-prices">
 			<span id="cart_block_shipping_cost" class="price ajax_cart_shipping_cost">{$shipping_cost}</span>
@@ -166,8 +164,8 @@ var generated_date = {$smarty.now|intval};
 			{/if}
 		{/if}
 		<p id="cart-buttons">
-			{if $order_process == 'order'}<a href="{$link->getPageLink("$order_process", true)}" class="button_small" title="{l s='View my shopping cart' mod='blockcart'}" rel="nofollow">{l s='Cart' mod='blockcart'}</a>{/if}
+			{if $order_process == 'order'}<a href="{$link->getPageLink("$order_process", true)|escape:'html'}" class="button_small" title="{l s='View my shopping cart' mod='blockcart'}" rel="nofollow">{l s='Cart' mod='blockcart'}</a>{/if}
-			<a href="{$link->getPageLink("$order_process", true)}" id="button_order_cart" class="exclusive{if $order_process == 'order-opc'}_large{/if}" title="{l s='Checkout' mod='blockcart'}" rel="nofollow"><span></span>{l s='Checkout' mod='blockcart'}</a>
+			<a href="{$link->getPageLink("$order_process", true)|escape:'html'}" id="button_order_cart" class="exclusive{if $order_process == 'order-opc'}_large{/if}" title="{l s='Checkout' mod='blockcart'}" rel="nofollow"><span></span>{l s='Checkout' mod='blockcart'}</a>
 		</p>
 	</div>
 	</div>

modules/blockcms/blockcms.tpl

@@ -27,17 +27,17 @@
 	<!-- Block CMS module -->
 	{foreach from=$cms_titles key=cms_key item=cms_title}
 		<div id="informations_block_left_{$cms_key}" class="block informations_block_left">
-			<h4 class="title_block"><a href="{$cms_title.category_link}">{if !empty($cms_title.name)}{$cms_title.name}{else}{$cms_title.category_name}{/if}</a></h4>
+			<h4 class="title_block"><a href="{$cms_title.category_link|escape:'html'}">{if !empty($cms_title.name)}{$cms_title.name}{else}{$cms_title.category_name}{/if}</a></h4>
 			<ul class="block_content">
 				{foreach from=$cms_title.categories item=cms_page}
 					{if isset($cms_page.link)}<li class="bullet"><b style="margin-left:2em;">
-					<a href="{$cms_page.link}" title="{$cms_page.name|escape:html:'UTF-8'}">{$cms_page.name|escape:html:'UTF-8'}</a>
+					<a href="{$cms_page.link|escape:'html'}" title="{$cms_page.name|escape:html:'UTF-8'}">{$cms_page.name|escape:html:'UTF-8'}</a>
 					</b></li>{/if}
 				{/foreach}
 				{foreach from=$cms_title.cms item=cms_page}
-					{if isset($cms_page.link)}<li><a href="{$cms_page.link}" title="{$cms_page.meta_title|escape:html:'UTF-8'}">{$cms_page.meta_title|escape:html:'UTF-8'}</a></li>{/if}
+					{if isset($cms_page.link)}<li><a href="{$cms_page.link|escape:'html'}" title="{$cms_page.meta_title|escape:html:'UTF-8'}">{$cms_page.meta_title|escape:html:'UTF-8'}</a></li>{/if}
 				{/foreach}
-				{if $cms_title.display_store}<li><a href="{$link->getPageLink('stores')}" title="{l s='Our stores' mod='blockcms'}">{l s='Our stores' mod='blockcms'}</a></li>{/if}
+				{if $cms_title.display_store}<li><a href="{$link->getPageLink('stores')|escape:'html'}" title="{l s='Our stores' mod='blockcms'}">{l s='Our stores' mod='blockcms'}</a></li>{/if}
 			</ul>
 		</div>
 	{/foreach}
@@ -47,17 +47,17 @@
 	<div class="block_various_links" id="block_various_links_footer">
 		<h4 class="title_block">{l s='Information' mod='blockcms'}</h4>
 		<ul>
-			{if !$PS_CATALOG_MODE}<li class="first_item"><a href="{$link->getPageLink('prices-drop')}" title="{l s='Specials' mod='blockcms'}">{l s='Specials' mod='blockcms'}</a></li>{/if}
+			{if !$PS_CATALOG_MODE}<li class="first_item"><a href="{$link->getPageLink('prices-drop')|escape:'html'}" title="{l s='Specials' mod='blockcms'}">{l s='Specials' mod='blockcms'}</a></li>{/if}
-			<li class="{if $PS_CATALOG_MODE}first_{/if}item"><a href="{$link->getPageLink('new-products')}" title="{l s='New products' mod='blockcms'}">{l s='New products' mod='blockcms'}</a></li>
+			<li class="{if $PS_CATALOG_MODE}first_{/if}item"><a href="{$link->getPageLink('new-products')|escape:'html'}" title="{l s='New products' mod='blockcms'}">{l s='New products' mod='blockcms'}</a></li>
-			{if !$PS_CATALOG_MODE}<li class="item"><a href="{$link->getPageLink('best-sales')}" title="{l s='Best sellers' mod='blockcms'}">{l s='Best sellers' mod='blockcms'}</a></li>{/if}
+			{if !$PS_CATALOG_MODE}<li class="item"><a href="{$link->getPageLink('best-sales')|escape:'html'}" title="{l s='Best sellers' mod='blockcms'}">{l s='Best sellers' mod='blockcms'}</a></li>{/if}
-			{if $display_stores_footer}<li class="item"><a href="{$link->getPageLink('stores')}" title="{l s='Our stores' mod='blockcms'}">{l s='Our stores' mod='blockcms'}</a></li>{/if}
+			{if $display_stores_footer}<li class="item"><a href="{$link->getPageLink('stores')|escape:'html'}" title="{l s='Our stores' mod='blockcms'}">{l s='Our stores' mod='blockcms'}</a></li>{/if}
-			<li class="item"><a href="{$link->getPageLink($contact_url, true)}" title="{l s='Contact us' mod='blockcms'}">{l s='Contact us' mod='blockcms'}</a></li>
+			<li class="item"><a href="{$link->getPageLink($contact_url, true)|escape:'html'}" title="{l s='Contact us' mod='blockcms'}">{l s='Contact us' mod='blockcms'}</a></li>
 			{foreach from=$cmslinks item=cmslink}
 				{if $cmslink.meta_title != ''}
-					<li class="item"><a href="{$cmslink.link|addslashes}" title="{$cmslink.meta_title|escape:'htmlall':'UTF-8'}">{$cmslink.meta_title|escape:'htmlall':'UTF-8'}</a></li>
+					<li class="item"><a href="{$cmslink.link|addslashes|escape:'html'}" title="{$cmslink.meta_title|escape:'htmlall':'UTF-8'}">{$cmslink.meta_title|escape:'htmlall':'UTF-8'}</a></li>
 				{/if}
 			{/foreach}
-			<li><a href="{$link->getPageLink('sitemap')}" title="{l s='Sitemap' mod='blockcms'}">{l s='Sitemap' mod='blockcms'}</a></li>
+			<li><a href="{$link->getPageLink('sitemap')|escape:'html'}" title="{l s='Sitemap' mod='blockcms'}">{l s='Sitemap' mod='blockcms'}</a></li>
 			{if $display_poweredby}<li class="last_item">{l s='Powered by' mod='blockcms'} <a class="_blank" href="http://www.prestashop.com">PrestaShop</a>&trade;</li>{/if}
 		</ul>
 	{$footer_text}

modules/blocklayered/blocklayered.php

@@ -2508,6 +2508,7 @@ class BlockLayered extends Module
 		else
 		{
 			$n = (int)Tools::getValue('n', Configuration::get('PS_PRODUCTS_PER_PAGE'));
+			$nb_day_new_product = (Validate::isUnsignedInt(Configuration::get('PS_NB_DAYS_NEW_PRODUCT')) ? Configuration::get('PS_NB_DAYS_NEW_PRODUCT') : 20);
 			$join = '';
 			if (version_compare(_PS_VERSION_,'1.5','>'))
 				$join = Shop::addSqlAssociation('product', 'p');
@@ -2520,12 +2521,12 @@ class BlockLayered extends Module
 				i.id_image,
 				il.legend, 
 				m.name manufacturer_name,
-				DATEDIFF('.$alias_where.'.`date_add`, DATE_SUB(NOW(), INTERVAL '.(Validate::isUnsignedInt(Configuration::get('PS_NB_DAYS_NEW_PRODUCT')) ? Configuration::get('PS_NB_DAYS_NEW_PRODUCT') : 20).' DAY)) > 0 AS new
+				DATEDIFF('.$alias_where.'.`date_add`, DATE_SUB(NOW(), INTERVAL '.(int)$nb_day_new_product.' DAY)) > 0 AS new
 			FROM `'._DB_PREFIX_.'category_product` cp
 			LEFT JOIN '._DB_PREFIX_.'category c ON (c.id_category = cp.id_category)
 			LEFT JOIN `'._DB_PREFIX_.'product` p ON p.`id_product` = cp.`id_product`
 			'.$join.'
-			LEFT JOIN '._DB_PREFIX_.'product_lang pl ON (pl.id_product = p.id_product'.Shop::addSqlRestrictionOnLang('pl').')
+			LEFT JOIN '._DB_PREFIX_.'product_lang pl ON (pl.id_product = p.id_product'.Shop::addSqlRestrictionOnLang('pl').' AND pl.id_lang = '.(int)$cookie->id_lang.')
 			LEFT JOIN '._DB_PREFIX_.'image i ON (i.id_product = p.id_product AND i.cover = 1)
 			LEFT JOIN '._DB_PREFIX_.'image_lang il ON (i.id_image = il.id_image AND il.id_lang = '.(int)($cookie->id_lang).')
 			LEFT JOIN '._DB_PREFIX_.'manufacturer m ON (m.id_manufacturer = p.id_manufacturer)
@@ -2533,9 +2534,9 @@ class BlockLayered extends Module
 			'.(Configuration::get('PS_LAYERED_FULL_TREE') ? 'c.nleft >= '.(int)$parent->nleft.'
 			AND c.nright <= '.(int)$parent->nright : 'c.id_category = '.(int)$id_parent).'
 			AND c.active = 1
-			AND pl.id_lang = '.(int)$cookie->id_lang.'
+			AND p.id_product IN ('.implode(',', $product_id_list).')
-			AND p.id_product IN ('.implode(',', $product_id_list).')'
+			GROUP BY cp.id_product
-			.' GROUP BY p.id_product ORDER BY '.Tools::getProductsOrder('by', Tools::getValue('orderby'), true).' '.Tools::getProductsOrder('way', Tools::getValue('orderway')).
+			ORDER BY '.Tools::getProductsOrder('by', Tools::getValue('orderby'), true).' '.Tools::getProductsOrder('way', Tools::getValue('orderway')).
 			' LIMIT '.(((int)$this->page - 1) * $n.','.$n));
 		}
 		

modules/blockmanufacturer/blockmanufacturer.tpl

@@ -25,14 +25,14 @@
 
 <!-- Block manufacturers module -->
 <div id="manufacturers_block_left" class="block blockmanufacturer">
-	<h4 class="title_block">{if $display_link_manufacturer}<a href="{$link->getPageLink('manufacturer')}" title="{l s='Manufacturers' mod='blockmanufacturer'}">{/if}{l s='Manufacturers' mod='blockmanufacturer'}{if $display_link_manufacturer}</a>{/if}</h4>
+	<h4 class="title_block">{if $display_link_manufacturer}<a href="{$link->getPageLink('manufacturer')|escape:'html'}" title="{l s='Manufacturers' mod='blockmanufacturer'}">{/if}{l s='Manufacturers' mod='blockmanufacturer'}{if $display_link_manufacturer}</a>{/if}</h4>
 	<div class="block_content">
 {if $manufacturers}
 	{if $text_list}
 	<ul class="bullet">
 	{foreach from=$manufacturers item=manufacturer name=manufacturer_list}
 		{if $smarty.foreach.manufacturer_list.iteration <= $text_list_nb}
-		<li class="{if $smarty.foreach.manufacturer_list.last}last_item{elseif $smarty.foreach.manufacturer_list.first}first_item{else}item{/if}"><a href="{$link->getmanufacturerLink($manufacturer.id_manufacturer, $manufacturer.link_rewrite)}" title="{l s='Learn more about' mod='blockmanufacturer'} {$manufacturer.name}">{$manufacturer.name|escape:'htmlall':'UTF-8'}</a></li>
+		<li class="{if $smarty.foreach.manufacturer_list.last}last_item{elseif $smarty.foreach.manufacturer_list.first}first_item{else}item{/if}"><a href="{$link->getmanufacturerLink($manufacturer.id_manufacturer, $manufacturer.link_rewrite)|escape:'html'}" title="{l s='Learn more about' mod='blockmanufacturer'} {$manufacturer.name}">{$manufacturer.name|escape:'htmlall':'UTF-8'}</a></li>
 		{/if}
 	{/foreach}
 	</ul>
@@ -43,7 +43,7 @@
 				<select id="manufacturer_list" onchange="autoUrl('manufacturer_list', '');">
 					<option value="0">{l s='All manufacturers' mod='blockmanufacturer'}</option>
 				{foreach from=$manufacturers item=manufacturer}
-					<option value="{$link->getmanufacturerLink($manufacturer.id_manufacturer, $manufacturer.link_rewrite)}">{$manufacturer.name|escape:'htmlall':'UTF-8'}</option>
+					<option value="{$link->getmanufacturerLink($manufacturer.id_manufacturer, $manufacturer.link_rewrite)|escape:'html'}">{$manufacturer.name|escape:'htmlall':'UTF-8'}</option>
 				{/foreach}
 				</select>
 			</p>

modules/blockmyaccount/blockmyaccount.tpl

@@ -25,18 +25,18 @@
 
 <!-- Block myaccount module -->
 <div class="block myaccount">
-	<h4 class="title_block"><a href="{$link->getPageLink('my-account', true)}" title="{l s='My account' mod='blockmyaccount'}">{l s='My account' mod='blockmyaccount'}</a></h4>
+	<h4 class="title_block"><a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='My account' mod='blockmyaccount'}">{l s='My account' mod='blockmyaccount'}</a></h4>
 	<div class="block_content">
 		<ul class="bullet">
-			<li><a href="{$link->getPageLink('history', true)}" title="">{l s='My orders' mod='blockmyaccount'}</a></li>
+			<li><a href="{$link->getPageLink('history', true)|escape:'html'}" title="">{l s='My orders' mod='blockmyaccount'}</a></li>
-			{if $returnAllowed}<li><a href="{$link->getPageLink('order-follow', true)}" title="{l s='My merchandise returns' mod='blockmyaccount'}">{l s='My merchandise returns' mod='blockmyaccount'}</a></li>{/if}
+			{if $returnAllowed}<li><a href="{$link->getPageLink('order-follow', true)|escape:'html'}" title="{l s='My merchandise returns' mod='blockmyaccount'}">{l s='My merchandise returns' mod='blockmyaccount'}</a></li>{/if}
-			<li><a href="{$link->getPageLink('order-slip', true)}" title="{l s='My credit slips' mod='blockmyaccount'}">{l s='My credit slips' mod='blockmyaccount'}</a></li>
+			<li><a href="{$link->getPageLink('order-slip', true)|escape:'html'}" title="{l s='My credit slips' mod='blockmyaccount'}">{l s='My credit slips' mod='blockmyaccount'}</a></li>
-			<li><a href="{$link->getPageLink('addresses', true)}" title="{l s='My addresses' mod='blockmyaccount'}">{l s='My addresses' mod='blockmyaccount'}</a></li>
+			<li><a href="{$link->getPageLink('addresses', true)|escape:'html'}" title="{l s='My addresses' mod='blockmyaccount'}">{l s='My addresses' mod='blockmyaccount'}</a></li>
-			<li><a href="{$link->getPageLink('identity', true)}" title="{l s='My personal info' mod='blockmyaccount'}">{l s='My personal info' mod='blockmyaccount'}</a></li>
+			<li><a href="{$link->getPageLink('identity', true)|escape:'html'}" title="{l s='My personal info' mod='blockmyaccount'}">{l s='My personal info' mod='blockmyaccount'}</a></li>
-			{if $voucherAllowed}<li><a href="{$link->getPageLink('discount', true)}" title="{l s='My vouchers' mod='blockmyaccount'}">{l s='My vouchers' mod='blockmyaccount'}</a></li>{/if}
+			{if $voucherAllowed}<li><a href="{$link->getPageLink('discount', true)|escape:'html'}" title="{l s='My vouchers' mod='blockmyaccount'}">{l s='My vouchers' mod='blockmyaccount'}</a></li>{/if}
 			{$HOOK_BLOCK_MY_ACCOUNT}
 		</ul>
-		<p class="logout"><a href="{$link->getPageLink('index', true, NULL, "mylogout")}" title="{l s='Sign out' mod='blockmyaccount'}">{l s='Sign out' mod='blockmyaccount'}</a></p>
+		<p class="logout"><a href="{$link->getPageLink('index', true, NULL, "mylogout")|escape:'html'}" title="{l s='Sign out' mod='blockmyaccount'}">{l s='Sign out' mod='blockmyaccount'}</a></p>
 	</div>
 </div>
 <!-- /Block myaccount module -->

modules/blockmyaccountfooter/blockmyaccountfooter.tpl

@@ -25,15 +25,15 @@
 
 <!-- Block myaccount module -->
 <div class="block myaccount">
-	<h4 class="title_block"><a href="{$link->getPageLink('my-account', true)}" title="{l s='Manage my customer account' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My account' mod='blockmyaccountfooter'}</a></h4>
+	<h4 class="title_block"><a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='Manage my customer account' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My account' mod='blockmyaccountfooter'}</a></h4>
 	<div class="block_content">
 		<ul class="bullet">
-			<li><a href="{$link->getPageLink('history', true)}" title="{l s='My orders' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My orders' mod='blockmyaccountfooter'}</a></li>
+			<li><a href="{$link->getPageLink('history', true)|escape:'html'}" title="{l s='My orders' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My orders' mod='blockmyaccountfooter'}</a></li>
-			{if $returnAllowed}<li><a href="{$link->getPageLink('order-follow', true)}" title="{l s='My returns' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My merchandise returns' mod='blockmyaccountfooter'}</a></li>{/if}
+			{if $returnAllowed}<li><a href="{$link->getPageLink('order-follow', true)|escape:'html'}" title="{l s='My returns' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My merchandise returns' mod='blockmyaccountfooter'}</a></li>{/if}
-			<li><a href="{$link->getPageLink('order-slip', true)}" title="{l s='My credit slips' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My credit slips' mod='blockmyaccountfooter'}</a></li>
+			<li><a href="{$link->getPageLink('order-slip', true)|escape:'html'}" title="{l s='My credit slips' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My credit slips' mod='blockmyaccountfooter'}</a></li>
-			<li><a href="{$link->getPageLink('addresses', true)}" title="{l s='My addresses' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My addresses' mod='blockmyaccountfooter'}</a></li>
+			<li><a href="{$link->getPageLink('addresses', true)|escape:'html'}" title="{l s='My addresses' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My addresses' mod='blockmyaccountfooter'}</a></li>
-			<li><a href="{$link->getPageLink('identity', true)}" title="{l s='Manage my personal information' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My personal info' mod='blockmyaccountfooter'}</a></li>
+			<li><a href="{$link->getPageLink('identity', true)|escape:'html'}" title="{l s='Manage my personal information' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My personal info' mod='blockmyaccountfooter'}</a></li>
-			{if $voucherAllowed}<li><a href="{$link->getPageLink('discount', true)}" title="{l s='My vouchers' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My vouchers' mod='blockmyaccountfooter'}</a></li>{/if}
+			{if $voucherAllowed}<li><a href="{$link->getPageLink('discount', true)|escape:'html'}" title="{l s='My vouchers' mod='blockmyaccountfooter'}" rel="nofollow">{l s='My vouchers' mod='blockmyaccountfooter'}</a></li>{/if}
 			{$HOOK_BLOCK_MY_ACCOUNT}
 		</ul>
 		<p class="logout"><a href="{$link->getPageLink('index')}?mylogout" title="{l s='Sign out' mod='blockmyaccountfooter'}" rel="nofollow">{l s='Sign out' mod='blockmyaccount'}</a></p>

modules/blocknewproducts/blocknewproducts.tpl

@@ -25,23 +25,23 @@
 
 <!-- MODULE Block new products -->
 <div id="new-products_block_right" class="block products_block">
-	<h4 class="title_block"><a href="{$link->getPageLink('new-products')}" title="{l s='New products' mod='blocknewproducts'}">{l s='New products' mod='blocknewproducts'}</a></h4>
+	<h4 class="title_block"><a href="{$link->getPageLink('new-products')|escape:'html'}" title="{l s='New products' mod='blocknewproducts'}">{l s='New products' mod='blocknewproducts'}</a></h4>
 	<div class="block_content">
 	{if $new_products !== false}
 		<ul class="product_images clearfix">
 		{foreach from=$new_products item='product' name='newProducts'}
 			{if $smarty.foreach.newProducts.index < 2}
-				<li{if $smarty.foreach.newProducts.first} class="first"{/if}><a href="{$product.link}" title="{$product.legend|escape:html:'UTF-8'}"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'medium_default')}" height="{$mediumSize.height}" width="{$mediumSize.width}" alt="{$product.legend|escape:html:'UTF-8'}" /></a></li>
+				<li{if $smarty.foreach.newProducts.first} class="first"{/if}><a href="{$product.link|escape:'html'}" title="{$product.legend|escape:html:'UTF-8'}"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'medium_default')|escape:'html'}" height="{$mediumSize.height}" width="{$mediumSize.width}" alt="{$product.legend|escape:html:'UTF-8'}" /></a></li>
 			{/if}
 		{/foreach}
 		</ul>
 		<dl class="products">
 		{foreach from=$new_products item=newproduct name=myLoop}
-			<dt class="{if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if}"><a href="{$newproduct.link}" title="{$newproduct.name|escape:html:'UTF-8'}">{$newproduct.name|strip_tags|escape:html:'UTF-8'}</a></dt>
+			<dt class="{if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if}"><a href="{$newproduct.link|escape:'html'}" title="{$newproduct.name|escape:html:'UTF-8'}">{$newproduct.name|strip_tags|escape:html:'UTF-8'}</a></dt>
-			{if $newproduct.description_short}<dd class="{if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if}"><a href="{$newproduct.link}">{$newproduct.description_short|strip_tags:'UTF-8'|truncate:75:'...'}</a><br /><a href="{$newproduct.link}" class="lnk_more">{l s='Read more' mod='blocknewproducts'}</a></dd>{/if}
+			{if $newproduct.description_short}<dd class="{if $smarty.foreach.myLoop.first}first_item{elseif $smarty.foreach.myLoop.last}last_item{else}item{/if}"><a href="{$newproduct.link|escape:'html'}">{$newproduct.description_short|strip_tags:'UTF-8'|truncate:75:'...'}</a><br /><a href="{$newproduct.link}" class="lnk_more">{l s='Read more' mod='blocknewproducts'}</a></dd>{/if}
 		{/foreach}
 		</dl>
-		<p><a href="{$link->getPageLink('new-products')}" title="{l s='All new products' mod='blocknewproducts'}" class="button_large">&raquo; {l s='All new products' mod='blocknewproducts'}</a></p>
+		<p><a href="{$link->getPageLink('new-products')|escape:'html'}" title="{l s='All new products' mod='blocknewproducts'}" class="button_large">&raquo; {l s='All new products' mod='blocknewproducts'}</a></p>
 	{else}
 		<p>&raquo; {l s='Do not allow new products at this time.' mod='blocknewproducts'}</p>
 	{/if}

modules/blocknewsletter/views/templates/hook/blocknewsletter.tpl

@@ -31,9 +31,9 @@
 	{if isset($msg) && $msg}
 		<p class="{if $nw_error}warning_inline{else}success_inline{/if}">{$msg}</p>
 	{/if}
-		<form action="{$link->getPageLink('index')}" method="post">
+		<form action="{$link->getPageLink('index')|escape:'html'}" method="post">
 			<p>
-				<input class="inputNew" id="newsletter-input" type="text" name="email" size="18" value="{if isset($value) && $value}{$value}{else}{l s='your e-mail' mod='blocknewsletter'}{/if}">
+				<input class="inputNew" id="newsletter-input" type="text" name="email" size="18" value="{if isset($value) && $value}{$value}{else}{l s='your e-mail' mod='blocknewsletter'}{/if}" />
 				<input type="submit" value="ok" class="button_mini" name="submitNewsletter" />
 				<input type="hidden" name="action" value="0" />
 			</p>
@@ -42,7 +42,7 @@
 </div>
 <!-- /Block Newsletter module-->
 
-<script>
+<script type="text/javascript">
     var placeholder = "{l s='your e-mail' mod='blocknewsletter' js=1}";
     {literal}
         $(document).ready(function() {

modules/blockpaymentlogo/blockpaymentlogo.tpl

@@ -25,7 +25,7 @@
 
 <!-- Block payment logo module -->
 <div id="paiement_logo_block_left" class="paiement_logo_block">
-	<a href="{$link->getCMSLink($cms_payement_logo)}">
+	<a href="{$link->getCMSLink($cms_payement_logo)|escape:'html'}">
 		<img src="{$img_dir}logo_paiement_visa.jpg" alt="visa" width="33" height="21" />
 		<img src="{$img_dir}logo_paiement_mastercard.jpg" alt="mastercard" width="32" height="21" />
 		<img src="{$img_dir}logo_paiement_paypal.jpg" alt="paypal" width="61" height="21" />

modules/blockpermanentlinks/blockpermanentlinks-footer.tpl

@@ -27,13 +27,13 @@
 <div id="permanent_links">
 	<!-- Sitemap -->
 	<div class="sitemap">
-		<a href="{$link->getPageLink('sitemap')}"><img src="{$img_dir}icon/sitemap.gif" alt="{l s='Sitemap' mod='blockpermanentlinks'}"/></a>&nbsp;
+		<a href="{$link->getPageLink('sitemap')|escape:'html'}"><img src="{$img_dir}icon/sitemap.gif" alt="{l s='Sitemap' mod='blockpermanentlinks'}"/></a>&nbsp;
-		<a href="{$link->getPageLink('sitemap')}" title="{l s='Sitemap' mod='blockpermanentlinks'}">{l s='Sitemap' mod='blockpermanentlinks'}</a>
+		<a href="{$link->getPageLink('sitemap')|escape:'html'}" title="{l s='Sitemap' mod='blockpermanentlinks'}">{l s='Sitemap' mod='blockpermanentlinks'}</a>
 	</div>
 	<!-- Contact -->
 	<div class="contact">
-		<a href="{$link->getPageLink('contact', true)}"><img src="{$img_dir}icon/contact.gif" alt="{l s='Contact' mod='blockpermanentlinks'}"/></a>&nbsp;
+		<a href="{$link->getPageLink('contact', true)|escape:'html'}"><img src="{$img_dir}icon/contact.gif" alt="{l s='Contact' mod='blockpermanentlinks'}"/></a>&nbsp;
-		<a href="{$link->getPageLink('contact', true)}" title="{l s='Contact' mod='blockpermanentlinks'}">{l s='Contact' mod='blockpermanentlinks'}</a>
+		<a href="{$link->getPageLink('contact', true)|escape:'html'}" title="{l s='Contact' mod='blockpermanentlinks'}">{l s='Contact' mod='blockpermanentlinks'}</a>
 	</div>
 	<!-- Bookmark -->
 	<div class="add_bookmark">

modules/blockpermanentlinks/blockpermanentlinks-header.tpl

@@ -25,8 +25,8 @@
 
 <!-- Block permanent links module HEADER -->
 <ul id="header_links">
-	<li id="header_link_contact"><a href="{$link->getPageLink('contact', true)}" title="{l s='contact' mod='blockpermanentlinks'}">{l s='contact' mod='blockpermanentlinks'}</a></li>
+	<li id="header_link_contact"><a href="{$link->getPageLink('contact', true)|escape:'html'}" title="{l s='contact' mod='blockpermanentlinks'}">{l s='contact' mod='blockpermanentlinks'}</a></li>
-	<li id="header_link_sitemap"><a href="{$link->getPageLink('sitemap')}" title="{l s='sitemap' mod='blockpermanentlinks'}">{l s='sitemap' mod='blockpermanentlinks'}</a></li>
+	<li id="header_link_sitemap"><a href="{$link->getPageLink('sitemap')|escape:'html'}" title="{l s='sitemap' mod='blockpermanentlinks'}">{l s='sitemap' mod='blockpermanentlinks'}</a></li>
 	<li id="header_link_bookmark">
 		<script type="text/javascript">writeBookmarkLink('{$come_from}', '{$meta_title|addslashes|addslashes}', '{l s='bookmark' mod='blockpermanentlinks' js=1}');</script>
 	</li>

modules/blockpermanentlinks/blockpermanentlinks.tpl

@@ -27,11 +27,11 @@
 <div id="permanent_links">
 	<!-- Sitemap -->
 	<div class="sitemap">
-		<a href="{$link->getPageLink('sitemap')}" title="{l s='Shop sitemap' mod='blockpermanentlinks'}">{l s='Sitemap' mod='blockpermanentlinks'}</a>
+		<a href="{$link->getPageLink('sitemap')|escape:'html'}" title="{l s='Shop sitemap' mod='blockpermanentlinks'}">{l s='Sitemap' mod='blockpermanentlinks'}</a>
 	</div>
 	<!-- Contact -->
 	<div class="contact">
-		<a href="{$link->getPageLink('contact', true)}" title="{l s='Contact form' mod='blockpermanentlinks'}">{l s='Contact' mod='blockpermanentlinks'}</a>
+		<a href="{$link->getPageLink('contact', true)|escape:'html'}" title="{l s='Contact form' mod='blockpermanentlinks'}">{l s='Contact' mod='blockpermanentlinks'}</a>
 	</div>
 	<!-- Bookmark -->
 	<div class="add_bookmark" style="height:30px;">

modules/blocksearch/blocksearch-top.tpl

@@ -25,7 +25,7 @@
 <!-- block seach mobile -->
 {if isset($hook_mobile)}
 <div class="input_search" data-role="fieldcontain">
-	<form method="get" action="{$link->getPageLink('search')}" id="searchbox">
+	<form method="get" action="{$link->getPageLink('search')|escape:'html'}" id="searchbox">
 		<input type="hidden" name="controller" value="search" />
 		<input type="hidden" name="orderby" value="position" />
 		<input type="hidden" name="orderway" value="desc" />
@@ -36,7 +36,7 @@
 <!-- Block search module TOP -->
 <div id="search_block_top">
 
-	<form method="get" action="{$link->getPageLink('search')}" id="searchbox">
+	<form method="get" action="{$link->getPageLink('search')|escape:'html'}" id="searchbox">
 		<p>
 			<label for="search_query_top"><!-- image on background --></label>
 			<input type="hidden" name="controller" value="search" />

modules/blocksearch/blocksearch.tpl

@@ -26,7 +26,7 @@
 <!-- Block search module -->
 <div id="search_block_left" class="block exclusive">
 	<h4 class="title_block">{l s='Search' mod='blocksearch'}</h4>
-	<form method="get" action="{$link->getPageLink('search', true)}" id="searchbox">
+	<form method="get" action="{$link->getPageLink('search', true)|escape:'html'}" id="searchbox">
 		<p class="block_content">
 			<label for="search_query_block">{l s='Enter a product name or description.' mod='blocksearch'}</label>
 			<input type="hidden" name="orderby" value="position" />

modules/blockspecials/blockspecials.tpl

@@ -25,13 +25,13 @@
 
 <!-- MODULE Block specials -->
 <div id="special_block_right" class="block products_block exclusive blockspecials">
-	<h4 class="title_block"><a href="{$link->getPageLink('prices-drop')}" title="{l s='Specials' mod='blockspecials'}">{l s='Specials' mod='blockspecials'}</a></h4>
+	<h4 class="title_block"><a href="{$link->getPageLink('prices-drop')|escape:'html'}" title="{l s='Specials' mod='blockspecials'}">{l s='Specials' mod='blockspecials'}</a></h4>
 	<div class="block_content">
 
 {if $special}
 		<ul class="products clearfix">
 			<li class="product_image">
-				<a href="{$special.link}"><img src="{$link->getImageLink($special.link_rewrite, $special.id_image, 'medium_default')}" alt="{$special.legend|escape:html:'UTF-8'}" height="{$mediumSize.height}" width="{$mediumSize.width}" title="{$special.name|escape:html:'UTF-8'}" /></a>
+				<a href="{$special.link}"><img src="{$link->getImageLink($special.link_rewrite, $special.id_image, 'medium_default')|escape:'html'}" alt="{$special.legend|escape:html:'UTF-8'}" height="{$mediumSize.height}" width="{$mediumSize.width}" title="{$special.name|escape:html:'UTF-8'}" /></a>
 			</li>
 			<li>
 				{if !$PS_CATALOG_MODE}
@@ -51,7 +51,7 @@
 			</li>
 		</ul>
 		<p>
-			<a href="{$link->getPageLink('prices-drop')}" title="{l s='All specials' mod='blockspecials'}">&raquo; {l s='All specials' mod='blockspecials'}</a>
+			<a href="{$link->getPageLink('prices-drop')|escape:'html'}" title="{l s='All specials' mod='blockspecials'}">&raquo; {l s='All specials' mod='blockspecials'}</a>
 		</p>
 {else}
 		<p>{l s='No product specials are available at this time.' mod='blockspecials'}</p>

modules/blockstore/blockstore.tpl

@@ -25,11 +25,11 @@
 
 <!-- Block stores module -->
 <div id="stores_block_left" class="block">
-	<h4 class="title_block"><a href="{$link->getPageLink('stores')}" title="{l s='Our store(s)!' mod='blockstore'}">{l s='Our store(s)!' mod='blockstore'}</a></h4>
+	<h4 class="title_block"><a href="{$link->getPageLink('stores')|escape:'html'}" title="{l s='Our store(s)!' mod='blockstore'}">{l s='Our store(s)!' mod='blockstore'}</a></h4>
 	<div class="block_content blockstore">
-		<p class="store_image"><a href="{$link->getPageLink('stores')}" title="{l s='Our store(s)!' mod='blockstore'}"><img src="{$module_dir}{$store_img}" alt="{l s='Our store(s)!' mod='blockstore'}" width="174" height="115" /></a></p>
+		<p class="store_image"><a href="{$link->getPageLink('stores')|escape:'html'}" title="{l s='Our store(s)!' mod='blockstore'}"><img src="{$module_dir}{$store_img}" alt="{l s='Our store(s)!' mod='blockstore'}" width="174" height="115" /></a></p>
 		<p>
-			<a href="{$link->getPageLink('stores')}" title="{l s='Our store(s)!' mod='blockstore'}">&raquo; {l s='Discover our store(s)d!' mod='blockstore'}</a>
+			<a href="{$link->getPageLink('stores')|escape:'html'}" title="{l s='Our store(s)!' mod='blockstore'}">&raquo; {l s='Discover our store(s)d!' mod='blockstore'}</a>
 		</p>
 	</div>
 </div>

modules/blocksupplier/blocksupplier.tpl

@@ -25,7 +25,7 @@
 
 <!-- Block suppliers module -->
 <div id="suppliers_block_left" class="block blocksupplier">
-	<h4 class="title_block">{if $display_link_supplier}<a href="{$link->getPageLink('supplier')}" title="{l s='Suppliers' mod='blocksupplier'}">{/if}{l s='Suppliers' mod='blocksupplier'}{if $display_link_supplier}</a>{/if}</h4>
+	<h4 class="title_block">{if $display_link_supplier}<a href="{$link->getPageLink('supplier')|escape:'html'}" title="{l s='Suppliers' mod='blocksupplier'}">{/if}{l s='Suppliers' mod='blocksupplier'}{if $display_link_supplier}</a>{/if}</h4>
 	<div class="block_content">
 {if $suppliers}
 	{if $text_list}
@@ -33,7 +33,7 @@
 	{foreach from=$suppliers item=supplier name=supplier_list}
 		{if $smarty.foreach.supplier_list.iteration <= $text_list_nb}
 		<li class="{if $smarty.foreach.supplier_list.last}last_item{elseif $smarty.foreach.supplier_list.first}first_item{else}item{/if}">
-			<a href="{$link->getsupplierLink($supplier.id_supplier, $supplier.link_rewrite)}" title="{l s='More about' mod='blocksupplier'} {$supplier.name}">{$supplier.name|escape:'htmlall':'UTF-8'}</a>
+			<a href="{$link->getsupplierLink($supplier.id_supplier, $supplier.link_rewrite)|escape:'html'}" title="{l s='More about' mod='blocksupplier'} {$supplier.name}">{$supplier.name|escape:'htmlall':'UTF-8'}</a>
 		</li>
 		{/if}
 	{/foreach}
@@ -45,7 +45,7 @@
 				<select id="supplier_list" onchange="autoUrl('supplier_list', '');">
 					<option value="0">{l s='All suppliers' mod='blocksupplier'}</option>
 				{foreach from=$suppliers item=supplier}
-					<option value="{$link->getsupplierLink($supplier.id_supplier, $supplier.link_rewrite)}">{$supplier.name|escape:'htmlall':'UTF-8'}</option>
+					<option value="{$link->getsupplierLink($supplier.id_supplier, $supplier.link_rewrite)|escape:'html'}">{$supplier.name|escape:'htmlall':'UTF-8'}</option>
 				{/foreach}
 				</select>
 			</p>

modules/blocktags/blocktags.tpl

@@ -29,7 +29,7 @@
 	<p class="block_content">
 {if $tags}
 	{foreach from=$tags item=tag name=myLoop}
-		<a href="{$link->getPageLink('search', true, NULL, "tag={$tag.name|urlencode}")}" title="{l s='More about' mod='blocktags'} {$tag.name|escape:html:'UTF-8'}" class="{$tag.class} {if $smarty.foreach.myLoop.last}last_item{elseif $smarty.foreach.myLoop.first}first_item{else}item{/if}">{$tag.name|escape:html:'UTF-8'}</a>
+		<a href="{$link->getPageLink('search', true, NULL, "tag={$tag.name|urlencode}")|escape:'html'}" title="{l s='More about' mod='blocktags'} {$tag.name|escape:html:'UTF-8'}" class="{$tag.class} {if $smarty.foreach.myLoop.last}last_item{elseif $smarty.foreach.myLoop.first}first_item{else}item{/if}">{$tag.name|escape:html:'UTF-8'}</a>
 	{/foreach}
 {else}
 	{l s='No tags have been specified yet.' mod='blocktags'}

modules/blocktopmenu/blocktopmenu.php

@@ -528,21 +528,21 @@ class Blocktopmenu extends Module
 					$selected = ($this->page_name == 'product' && (Tools::getValue('id_product') == $id)) ? ' class="sfHover"' : '';
 					$product = new Product((int)$id, true, (int)$id_lang);
 					if (!is_null($product->id))
-						$this->_menu .= '<li'.$selected.'><a href="'.$product->getLink().'">'.$product->name.'</a></li>'.PHP_EOL;
+						$this->_menu .= '<li'.$selected.'><a href="'.htmlentities($product->getLink()).'">'.$product->name.'</a></li>'.PHP_EOL;
 					break;
 
 				case 'CMS':
 					$selected = ($this->page_name == 'cms' && (Tools::getValue('id_cms') == $id)) ? ' class="sfHover"' : '';
 					$cms = CMS::getLinks((int)$id_lang, array($id));
 					if (count($cms))
-						$this->_menu .= '<li'.$selected.'><a href="'.$cms[0]['link'].'">'.$cms[0]['meta_title'].'</a></li>'.PHP_EOL;
+						$this->_menu .= '<li'.$selected.'><a href="'.htmlentities($cms[0]['link']).'">'.$cms[0]['meta_title'].'</a></li>'.PHP_EOL;
 					break;
 
 				case 'CMS_CAT':
 					$category = new CMSCategory((int)$id, (int)$id_lang);
 					if (count($category))
 					{
-						$this->_menu .= '<li><a href="'.$category->getLink().'">'.$category->name.'</a>';
+						$this->_menu .= '<li><a href="'.htmlentities($category->getLink()).'">'.$category->name.'</a>';
 						$this->getCMSMenuItems($category->id);
 						$this->_menu .= '</li>'.PHP_EOL;
 					}
@@ -558,7 +558,7 @@ class Blocktopmenu extends Module
 						else
 							$manufacturer->link_rewrite = 0;
 						$link = new Link;
-						$this->_menu .= '<li'.$selected.'><a href="'.$link->getManufacturerLink((int)$id, $manufacturer->link_rewrite).'">'.$manufacturer->name.'</a></li>'.PHP_EOL;
+						$this->_menu .= '<li'.$selected.'><a href="'.htmlentities($link->getManufacturerLink((int)$id, $manufacturer->link_rewrite)).'">'.$manufacturer->name.'</a></li>'.PHP_EOL;
 					}
 					break;
 
@@ -568,7 +568,7 @@ class Blocktopmenu extends Module
 					if (!is_null($supplier->id))
 					{
 						$link = new Link;
-						$this->_menu .= '<li'.$selected.'><a href="'.$link->getSupplierLink((int)$id, $supplier->link_rewrite).'">'.$supplier->name.'</a></li>'.PHP_EOL;
+						$this->_menu .= '<li'.$selected.'><a href="'.htmlentities($link->getSupplierLink((int)$id, $supplier->link_rewrite)).'">'.$supplier->name.'</a></li>'.PHP_EOL;
 					}
 					break;
 
@@ -578,7 +578,7 @@ class Blocktopmenu extends Module
 					if (Validate::isLoadedObject($shop))
 					{
 						$link = new Link;
-						$this->_menu .= '<li'.$selected.'><a href="'.$shop->getBaseURL().'">'.$shop->name.'</a></li>'.PHP_EOL;
+						$this->_menu .= '<li'.$selected.'><a href="'.htmlentities($shop->getBaseURL()).'">'.$shop->name.'</a></li>'.PHP_EOL;
 					}
 					break;
 				case 'LNK':
@@ -590,7 +590,7 @@ class Blocktopmenu extends Module
 							$default_language = Configuration::get('PS_LANG_DEFAULT');
 							$link = MenuTopLinks::get($link[0]['id_linksmenutop'], $default_language, (int)Shop::getContextShopID());
 						}
-						$this->_menu .= '<li><a href="'.$link[0]['link'].'"'.(($link[0]['new_window']) ? ' target="_blank"': '').'>'.$link[0]['label'].'</a></li>'.PHP_EOL;
+						$this->_menu .= '<li><a href="'.htmlentities($link[0]['link']).'"'.(($link[0]['new_window']) ? ' target="_blank"': '').'>'.$link[0]['label'].'</a></li>'.PHP_EOL;
 					}
 					break;
 			}
@@ -642,7 +642,7 @@ class Blocktopmenu extends Module
 		if (!empty($is_intersected))
 		{
 			$this->_menu .= '<li '.$selected.'>';
-			$this->_menu .= '<a href="'.$category_link.'">'.$category->name.'</a>';
+			$this->_menu .= '<a href="'.htmlentities($category_link).'">'.$category->name.'</a>';
 
 			if (count($children))
 			{

modules/blocktopmenu/blocktopmenu.tpl

@@ -6,7 +6,7 @@
 			{$MENU}
 			{if $MENU_SEARCH}
 				<li class="sf-search noBack" style="float:right">
-					<form id="searchbox" action="{$link->getPageLink('search')}" method="get">
+					<form id="searchbox" action="{$link->getPageLink('search')|escape:'html'}" method="get">
 						<p>
 							<input type="hidden" name="controller" value="search" />
 							<input type="hidden" value="position" name="orderby"/>

modules/blockuserinfo/blockuserinfo.tpl

@@ -28,7 +28,7 @@
 	<ul id="header_nav">
 		{if !$PS_CATALOG_MODE}
 		<li id="shopping_cart">
-			<a href="{$link->getPageLink($order_process, true)}" title="{l s='View my shopping cart' mod='blockuserinfo'}" rel="nofollow">{l s='Cart' mod='blockuserinfo'}
+			<a href="{$link->getPageLink($order_process, true)|escape:'html'}" title="{l s='View my shopping cart' mod='blockuserinfo'}" rel="nofollow">{l s='Cart' mod='blockuserinfo'}
 			<span class="ajax_cart_quantity{if $cart_qties == 0} hidden{/if}">{$cart_qties}</span>
 			<span class="ajax_cart_product_txt{if $cart_qties != 1} hidden{/if}">{l s='Product' mod='blockuserinfo'}</span>
 			<span class="ajax_cart_product_txt_s{if $cart_qties < 2} hidden{/if}">{l s='Products' mod='blockuserinfo'}</span>
@@ -47,15 +47,15 @@
 			</a>
 		</li>
 		{/if}
-		<li id="your_account"><a href="{$link->getPageLink('my-account', true)}" title="{l s='View my customer account' mod='blockuserinfo'}" rel="nofollow">{l s='Your Account' mod='blockuserinfo'}</a></li>
+		<li id="your_account"><a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='View my customer account' mod='blockuserinfo'}" rel="nofollow">{l s='Your Account' mod='blockuserinfo'}</a></li>
 	</ul>
 	<p id="header_user_info">
 		{l s='Welcome' mod='blockuserinfo'}
 		{if $logged}
-			<a href="{$link->getPageLink('my-account', true)}" title="{l s='View my customer account' mod='blockuserinfo'}" class="account" rel="nofollow"><span>{$cookie->customer_firstname} {$cookie->customer_lastname}</span></a>
+			<a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='View my customer account' mod='blockuserinfo'}" class="account" rel="nofollow"><span>{$cookie->customer_firstname} {$cookie->customer_lastname}</span></a>
-			<a href="{$link->getPageLink('index', true, NULL, "mylogout")}" title="{l s='Log me out' mod='blockuserinfo'}" class="logout" rel="nofollow">{l s='Log out' mod='blockuserinfo'}</a>
+			<a href="{$link->getPageLink('index', true, NULL, "mylogout")|escape:'html'}" title="{l s='Log me out' mod='blockuserinfo'}" class="logout" rel="nofollow">{l s='Log out' mod='blockuserinfo'}</a>
 		{else}
-			<a href="{$link->getPageLink('my-account', true)}" title="{l s='Login to your customer account' mod='blockuserinfo'}" class="login" rel="nofollow">{l s='Login' mod='blockuserinfo'}</a>
+			<a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='Login to your customer account' mod='blockuserinfo'}" class="login" rel="nofollow">{l s='Login' mod='blockuserinfo'}</a>
 		{/if}
 	</p>
 </div>

modules/blockviewed/blockviewed.tpl

@@ -30,12 +30,12 @@
 		<ul class="products clearfix">
 			{foreach from=$productsViewedObj item=viewedProduct name=myLoop}
 				<li class="clearfix{if $smarty.foreach.myLoop.last} last_item{elseif $smarty.foreach.myLoop.first} first_item{else} item{/if}">
-					<a href="{$viewedProduct->product_link}" title="{l s='About' mod='blockviewed'} {$viewedProduct->name|escape:html:'UTF-8'}" class="content_img">
+					<a href="{$viewedProduct->product_link|escape:'html'}" title="{l s='About' mod='blockviewed'} {$viewedProduct->name|escape:html:'UTF-8'}" class="content_img">
 					<img src="{if isset($viewedProduct->id_image) && $viewedProduct->id_image}{$link->getImageLink($viewedProduct->link_rewrite, $viewedProduct->cover, 'medium_default')}{else}{$img_prod_dir}{$lang_iso}-default-medium_default.jpg{/if}" alt="{$viewedProduct->legend|escape:html:'UTF-8'}" />
 					</a>
 					<div class="text_desc">
-						<h5 class="s_title_block"><a href="{$viewedProduct->product_link}" title="{l s='About' mod='blockviewed'} {$viewedProduct->name|escape:html:'UTF-8'}">{$viewedProduct->name|truncate:14:'...'|escape:html:'UTF-8'}</a></h5>
+						<h5 class="s_title_block"><a href="{$viewedProduct->product_link|escape:'html'}" title="{l s='About' mod='blockviewed'} {$viewedProduct->name|escape:html:'UTF-8'}">{$viewedProduct->name|truncate:14:'...'|escape:html:'UTF-8'}</a></h5>
-						<p><a href="{$viewedProduct->product_link}" title="{l s='About' mod='blockviewed'} {$viewedProduct->name|escape:html:'UTF-8'}">{$viewedProduct->description_short|strip_tags:'UTF-8'|truncate:44}</a></p>
+						<p><a href="{$viewedProduct->product_link|escape:'html'}" title="{l s='About' mod='blockviewed'} {$viewedProduct->name|escape:html:'UTF-8'}">{$viewedProduct->description_short|strip_tags:'UTF-8'|truncate:44}</a></p>
 					</div>
 				</li>
 			{/foreach}

modules/blockwishlist/blockwishlist-ajax.tpl

@@ -28,12 +28,12 @@
 	{foreach from=$products item=product name=i}
 		<dt class="{if $smarty.foreach.i.first}first_item{elseif $smarty.foreach.i.last}last_item{else}item{/if}">
 			<span class="quantity-formated"><span class="quantity">{$product.quantity|intval}</span>x</span>
-			<a class="cart_block_product_name" href="{$link->getProductLink($product.id_product, $product.link_rewrite, $product.category_rewrite)}" title="{$product.name|escape:'htmlall':'UTF-8'}" style="font-weight:bold;">{$product.name|truncate:13:'...'|escape:'htmlall':'UTF-8'}</a>
+			<a class="cart_block_product_name" href="{$link->getProductLink($product.id_product, $product.link_rewrite, $product.category_rewrite)|escape:'html'}" title="{$product.name|escape:'htmlall':'UTF-8'}" style="font-weight:bold;">{$product.name|truncate:13:'...'|escape:'htmlall':'UTF-8'}</a>
 			<a class="ajax_cart_block_remove_link" href="javascript:;" onclick="javascript:WishlistCart('wishlist_block_list', 'delete', '{$product.id_product}', {$product.id_product_attribute}, '0');" title="{l s='remove this product from my wishlist' mod='blockwishlist'}" rel="nofollow"><img src="{$img_dir}icon/delete.gif" width="12" height="12" alt="{l s='Delete'}" class="icon" /></a>
 		</dt>
 		{if isset($product.attributes_small)}
 		<dd class="{if $smarty.foreach.i.first}first_item{elseif $smarty.foreach.i.last}last_item{else}item{/if}" style="font-style:italic;margin:0 0 0 10px;">
-			<a href="{$link->getProductLink($product.id_product, $product.link_rewrite)}" title="{l s='Product detail'}">{$product.attributes_small|escape:'htmlall':'UTF-8'}</a>
+			<a href="{$link->getProductLink($product.id_product, $product.link_rewrite)|escape:'html'}" title="{l s='Product detail'}">{$product.attributes_small|escape:'htmlall':'UTF-8'}</a>
 		</dd>
 		{/if}
 	{/foreach}

modules/blockwishlist/blockwishlist.tpl

@@ -35,12 +35,12 @@
 				<dt class="{if $smarty.foreach.i.first}first_item{elseif $smarty.foreach.i.last}last_item{else}item{/if}">
 					<span class="quantity-formated"><span class="quantity">{$product.quantity|intval}</span>x</span>
 					<a class="cart_block_product_name"
-					href="{$link->getProductLink($product.id_product, $product.link_rewrite, $product.category_rewrite)}" title="{$product.name|escape:'htmlall':'UTF-8'}">{$product.name|truncate:30:'...'|escape:'htmlall':'UTF-8'}</a>
+					href="{$link->getProductLink($product.id_product, $product.link_rewrite, $product.category_rewrite)|escape:'html'}" title="{$product.name|escape:'htmlall':'UTF-8'}">{$product.name|truncate:30:'...'|escape:'htmlall':'UTF-8'}</a>
 					<a class="ajax_cart_block_remove_link" href="javascript:;" onclick="javascript:WishlistCart('wishlist_block_list', 'delete', '{$product.id_product}', {$product.id_product_attribute}, '0', '{$token}');" title="{l s='remove this product from my wishlist' mod='blockwishlist'}" rel="nofollow"><img src="{$img_dir}icon/delete.gif" width="12" height="12" alt="{l s='Delete'}" class="icon" /></a>
 				</dt>
 				{if isset($product.attributes_small)}
 				<dd class="{if $smarty.foreach.i.first}first_item{elseif $smarty.foreach.i.last}last_item{else}item{/if}">
-					<a href="{$link->getProductLink($product.id_product, $product.link_rewrite, $product.category_rewrite)}" title="{l s='Product detail'}">{$product.attributes_small|escape:'htmlall':'UTF-8'}</a>
+					<a href="{$link->getProductLink($product.id_product, $product.link_rewrite, $product.category_rewrite)|escape:'html'}" title="{l s='Product detail'}">{$product.attributes_small|escape:'htmlall':'UTF-8'}</a>
 				</dd>
 				{/if}
 			{/foreach}

modules/blockwishlist/managewishlist.tpl

@@ -51,15 +51,15 @@
 				<a href="javascript:;" class="lnkdel" onclick="WishlistProductManage('wlp_bought', 'delete', '{$id_wishlist}', '{$product.id_product}', '{$product.id_product_attribute}', $('#quantity_{$product.id_product}_{$product.id_product_attribute}').val(), $('#priority_{$product.id_product}_{$product.id_product_attribute}').val());" title="{l s='Delete' mod='blockwishlist'}">&raquo; {l s='Delete' mod='blockwishlist'}</a>
 				<div class="clearfix">
 					<div class="product_image">
-						<a href="{$link->getProductlink($product.id_product, $product.link_rewrite, $product.category_rewrite)}" title="{l s='Product detail' mod='blockwishlist'}">
+						<a href="{$link->getProductlink($product.id_product, $product.link_rewrite, $product.category_rewrite)|escape:'html'}" title="{l s='Product detail' mod='blockwishlist'}">
-							<img src="{$link->getImageLink($product.link_rewrite, $product.cover, 'medium_default')}" alt="{$product.name|escape:'htmlall':'UTF-8'}" />
+							<img src="{$link->getImageLink($product.link_rewrite, $product.cover, 'medium_default')|escape:'html'}" alt="{$product.name|escape:'htmlall':'UTF-8'}" />
 						</a>
 					</div>
 					<div class="product_infos">
 						<p id="s_title" class="product_name">{$product.name|truncate:30:'...'|escape:'htmlall':'UTF-8'}</p>
 						<span class="wishlist_product_detail">
 						{if isset($product.attributes_small)}
-							<a href="{$link->getProductlink($product.id_product, $product.link_rewrite, $product.category_rewrite)}" title="{l s='Product detail' mod='blockwishlist'}">{$product.attributes_small|escape:'htmlall':'UTF-8'}</a>
+							<a href="{$link->getProductlink($product.id_product, $product.link_rewrite, $product.category_rewrite)|escape:'html'}" title="{l s='Product detail' mod='blockwishlist'}">{$product.attributes_small|escape:'htmlall':'UTF-8'}</a>
 						{/if}
 							<br />{l s='Quantity' mod='blockwishlist'}:<input type="text" id="quantity_{$product.id_product}_{$product.id_product_attribute}" value="{$product.quantity|intval}" size="3"  />
 							<br /><br />
@@ -116,7 +116,7 @@
 			{if $bought.quantity > 0}
 				<tr>
 					<td class="first_item">
-						<span style="float:left;"><img src="{$link->getImageLink($product.link_rewrite, $product.cover, 'small')}" alt="{$product.name|escape:'htmlall':'UTF-8'}" /></span>			
+						<span style="float:left;"><img src="{$link->getImageLink($product.link_rewrite, $product.cover, 'small')|escape:'html'}" alt="{$product.name|escape:'htmlall':'UTF-8'}" /></span>			
 						<span style="float:left;">
 							{$product.name|truncate:40:'...'|escape:'htmlall':'UTF-8'}
 						{if isset($product.attributes_small)}

modules/blockwishlist/view.tpl

@@ -48,12 +48,12 @@
 		<li class="address_title"><a href="{$link->getProductLink($product.id_product,
 		$product.link_rewrite, $product.category_rewrite)}" title="{l s='View' mod='blockwishlist'}">{$product.name|truncate:30:'...'|escape:'htmlall':'UTF-8'}</a></li>
 		<li class="address_name">
-			<a href="{$link->getProductlink($product.id_product, $product.link_rewrite, $product.category_rewrite)}" title="{l s='Product detail' mod='blockwishlist'}" class="product_image"  title="{$product.name|escape:'htmlall':'UTF-8'}">
+			<a href="{$link->getProductlink($product.id_product, $product.link_rewrite, $product.category_rewrite)|escape:'html'}" title="{l s='Product detail' mod='blockwishlist'}" class="product_image"  title="{$product.name|escape:'htmlall':'UTF-8'}">
-				<img src="{$link->getImageLink($product.link_rewrite, $product.cover, 'medium')}" alt="{$product.name|escape:'htmlall':'UTF-8'}" />				
+				<img src="{$link->getImageLink($product.link_rewrite, $product.cover, 'medium')|escape:'html'}" alt="{$product.name|escape:'htmlall':'UTF-8'}" />				
 			</a>
 		<span class="wishlist_product_detail">
 		{if isset($product.attributes_small)}
-			<br /><a href="{$link->getProductlink($product.id_product, $product.link_rewrite, $product.category_rewrite)}" title="{l s='Product detail' mod='blockwishlist'}">{$product.attributes_small|escape:'htmlall':'UTF-8'}</a>
+			<br /><a href="{$link->getProductlink($product.id_product, $product.link_rewrite, $product.category_rewrite)|escape:'html'}" title="{l s='Product detail' mod='blockwishlist'}">{$product.attributes_small|escape:'htmlall':'UTF-8'}</a>
 		{/if}
 			<br />{l s='Quantity:' mod='blockwishlist'}<input type="text" id="{$product.id_product}_{$product.id_product_attribute}" size="3" value="{$product.quantity|intval}" readonly/>
 			<br />{l s='Priority:' mod='blockwishlist'}
@@ -67,10 +67,10 @@
 		</span>
 		</li>
 		<li class="address_address1 clear">
-			<a class="button_small clear" href="{$link->getProductLink($product.id_product,  $product.link_rewrite, $product.category_rewrite)}" title="{l s='View' mod='blockwishlist'}" rel="nofollow">{l s='View' mod='blockwishlist'}</a>
+			<a class="button_small clear" href="{$link->getProductLink($product.id_product,  $product.link_rewrite, $product.category_rewrite)|escape:'html'}" title="{l s='View' mod='blockwishlist'}" rel="nofollow">{l s='View' mod='blockwishlist'}</a>
 			{if isset($product.attribute_quantity) AND $product.attribute_quantity >= 1 OR !isset($product.attribute_quantity) AND $product.product_quantity >= 1}
 			{if !$ajax}
-			<form id="addtocart_{$product.id_product|intval}_{$product.id_product_attribute|intval}" action="{$link->getPageLink('cart')}" method="post">
+			<form id="addtocart_{$product.id_product|intval}_{$product.id_product_attribute|intval}" action="{$link->getPageLink('cart')|escape:'html'}" method="post">
 			<p class="hidden">
 				<input type="hidden" name="id_product" value="{$product.id_product|intval}" id="product_page_product_id"  />
 				<input type="hidden" name="add" value="1" />

modules/blockwishlist/views/templates/front/mywishlist.tpl

@@ -24,7 +24,7 @@
 *}
 
 <div id="mywishlist">
-	{capture name=path}<a href="{$link->getPageLink('my-account', true)}">{l s='My account' mod='blockwishlist'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='My wishlists' mod='blockwishlist'}{/capture}
+	{capture name=path}<a href="{$link->getPageLink('my-account', true)|escape:'html'}">{l s='My account' mod='blockwishlist'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='My wishlists' mod='blockwishlist'}{/capture}
 	{include file="$tpl_dir./breadcrumb.tpl"}
 
 	<h2>{l s='My wishlists' mod='blockwishlist'}</h2>
@@ -93,7 +93,7 @@
 	{/if}
 
 	<ul class="footer_links">
-		<li><a href="{$link->getPageLink('my-account', true)}"><img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /></a><a href="{$link->getPageLink('my-account', true)}">{l s='Back to Your Account' mod='blockwishlist'}</a></li>
+		<li><a href="{$link->getPageLink('my-account', true)}"><img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /></a><a href="{$link->getPageLink('my-account', true)|escape:'html'}">{l s='Back to Your Account' mod='blockwishlist'}</a></li>
 		<li class="f_right"><a href="{$base_dir}"><img src="{$img_dir}icon/home.gif" alt="" class="icon" /></a><a href="{$base_dir}">{l s='Home' mod='blockwishlist'}</a></li>
 	</ul>
 </div>

modules/cashondelivery/views/templates/front/validation.tpl

@@ -33,7 +33,7 @@
 
 <h3>{l s='Cash on delivery (COD) payment' mod='cashondelivery'}</h3>
 
-<form action="{$link->getModuleLink('cashondelivery', 'validation', [], true)}" method="post">
+<form action="{$link->getModuleLink('cashondelivery', 'validation', [], true)|escape:'html'}" method="post">
 	<input type="hidden" name="confirm" value="1" />
 	<p>
 		<img src="{$this_path_cod}cashondelivery.jpg" alt="{l s='Cash on delivery (COD) payment' mod='cashondelivery'}" style="float:left; margin: 0px 10px 5px 0px;" />

modules/cashondelivery/views/templates/hook/confirmation.tpl

@@ -27,5 +27,5 @@
 	<br /><br />
 	{l s='You have chosen the cash on delivery method.' mod='cashondelivery'}
 	<br /><br /><span class="bold">{l s='Your order will be sent very soon.' mod='cashondelivery'}</span>
-	<br /><br />{l s='For any questions or for further information, please contact our' mod='cashondelivery'} <a href="{$link->getPageLink('contact-form', true)}">{l s='customer support' mod='cashondelivery'}</a>.
+	<br /><br />{l s='For any questions or for further information, please contact our' mod='cashondelivery'} <a href="{$link->getPageLink('contact-form', true)|escape:'html'}">{l s='customer support' mod='cashondelivery'}</a>.
 </p>

modules/cashondelivery/views/templates/hook/payment.tpl

@@ -24,7 +24,7 @@
 *}
 
 <p class="payment_module">
-	<a href="{$link->getModuleLink('cashondelivery', 'validation', [], true)}" title="{l s='Pay with cash on delivery (COD)' mod='cashondelivery'}" rel="nofollow">
+	<a href="{$link->getModuleLink('cashondelivery', 'validation', [], true)|escape:'html'}" title="{l s='Pay with cash on delivery (COD)' mod='cashondelivery'}" rel="nofollow">
 		<img src="{$this_path_cod}cashondelivery.gif" alt="{l s='Pay with cash on delivery (COD)' mod='cashondelivery'}" style="float:left;" />
 		<br />{l s='Pay with cash on delivery (COD)' mod='cashondelivery'}
 		<br />{l s='You pay for the merchandise upon delivery' mod='cashondelivery'}

modules/cheque/views/templates/front/payment_execution.tpl

@@ -36,7 +36,7 @@
 {else}
 
 <h3>{l s='Check payment' mod='cheque'}</h3>
-<form action="{$link->getModuleLink('cheque', 'validation', [], true)}" method="post">
+<form action="{$link->getModuleLink('cheque', 'validation', [], true)|escape:'html'}" method="post">
 	<p>
 		<img src="{$this_path_cheque}cheque.jpg" alt="{l s='Check' mod='cheque'}" width="86" height="49" style="float:left; margin: 0px 10px 5px 0px;" />
 		{l s='You have chosen to pay by check.' mod='cheque'}
@@ -73,7 +73,7 @@
 	</p>
 	<p class="cart_navigation">
 		<input type="submit" name="submit" value="{l s='I confirm my order' mod='cheque'}" class="exclusive_large" />
-		<a href="{$link->getPageLink('order', true, NULL, "step=3")}" class="button_large">{l s='Other payment methods' mod='cheque'}</a>
+		<a href="{$link->getPageLink('order', true, NULL, "step=3")|escape:'html'}" class="button_large">{l s='Other payment methods' mod='cheque'}</a>
 	</p>
 </form>
 {/if}

modules/cheque/views/templates/hook/payment.tpl

@@ -24,7 +24,7 @@
 *}
 
 <p class="payment_module">
-	<a href="{$link->getModuleLink('cheque', 'payment', [], true)}" title="{l s='Pay by check.' mod='cheque'}">
+	<a href="{$link->getModuleLink('cheque', 'payment', [], true)|escape:'html'}" title="{l s='Pay by check.' mod='cheque'}">
 		<img src="{$this_path_cheque}cheque.jpg" alt="{l s='Pay by check.' mod='cheque'}" width="86" height="49" />
 		{l s='Pay by check (order processing will take more time).' mod='cheque'}
 	</a>

modules/cheque/views/templates/hook/payment_return.tpl

@@ -37,11 +37,11 @@
 		{/if}
 		<br /><br />{l s='An email has been sent to you with this information.' mod='cheque'}
 		<br /><br /><strong>{l s='Your order will be sent as soon as we receive your payment.' mod='cheque'}</strong>
-		<br /><br />{l s='For any questions or for further information, please contact our' mod='cheque'} <a href="{$link->getPageLink('contact', true)}">{l s='customer service department.' mod='cheque'}</a>.
+		<br /><br />{l s='For any questions or for further information, please contact our' mod='cheque'} <a href="{$link->getPageLink('contact', true)|escape:'html'}">{l s='customer service department.' mod='cheque'}</a>.
 	</p>
 {else}
 	<p class="warning">
 		{l s='We have noticed that there is a problem with your order. If you think this is an error, you can contact our' mod='cheque'} 
-		<a href="{$link->getPageLink('contact', true)}">{l s='customer service department.' mod='cheque'}</a>.
+		<a href="{$link->getPageLink('contact', true)|escape:'html'}">{l s='customer service department.' mod='cheque'}</a>.
 	</p>
 {/if}

modules/editorial/EditorialClass.php

@@ -68,10 +68,7 @@ class EditorialClass extends ObjectModel
 	static public function getByIdShop($id_shop)
 	{
 		$id = Db::getInstance()->getValue('SELECT `id_editorial` FROM `'._DB_PREFIX_.'editorial` WHERE `id_shop` ='.(int)$id_shop);
-		if ($id)
+		return new EditorialClass($id);
-			return new EditorialClass((int)$id);
-		else
-			return false;
 	}
 
 	public function copyFromPost()

modules/editorial/editorial.tpl

@@ -26,7 +26,7 @@
 <!-- Module Editorial -->
 <div id="editorial_block_center" class="editorial_block">
 	{if $editorial->body_home_logo_link}<a href="{$editorial->body_home_logo_link|escape:'htmlall':'UTF-8'}" title="{$editorial->body_title|escape:'htmlall':'UTF-8'|stripslashes}">{/if}
-	{if $homepage_logo}<img src="{$link->getMediaLink($image_path)}" alt="{$editorial->body_title|escape:'htmlall':'UTF-8'|stripslashes}" {if $image_width}width="{$image_width}"{/if} {if $image_height}height="{$image_height}" {/if}/>{/if}
+	{if $homepage_logo}<img src="{$link->getMediaLink($image_path)|escape:'html'}" alt="{$editorial->body_title|escape:'htmlall':'UTF-8'|stripslashes}" {if $image_width}width="{$image_width}"{/if} {if $image_height}height="{$image_height}" {/if}/>{/if}
 	{if $editorial->body_home_logo_link}</a>{/if}
 	{if $editorial->body_logo_subheading}<p id="editorial_image_legend">{$editorial->body_logo_subheading|stripslashes}</p>{/if}
 	{if $editorial->body_title}<h1>{$editorial->body_title|stripslashes}</h1>{/if}

modules/favoriteproducts/views/templates/front/favoriteproducts-account.tpl

@@ -32,7 +32,7 @@ $('document').ready(function()
 		var parent = $(this).parent().parent();
 
 		$.ajax({
-			url: "{$link->getModuleLink('favoriteproducts', 'actions', ['process' => 'remove'], true)}",
+			url: "{$link->getModuleLink('favoriteproducts', 'actions', ['process' => 'remove'], true)|escape:'html'}",
 			type: "POST",
 			data: {
 				'id_product': idFavoriteProduct,

modules/favoriteproducts/views/templates/hook/favoriteproducts-header.tpl

@@ -23,8 +23,8 @@
 *  International Registered Trademark & Property of PrestaShop SA
 *}
 <script type="text/javascript">
-	var favorite_products_url_add = '{$link->getModuleLink('favoriteproducts', 'actions', ['process' => 'add'], false)}';
+	var favorite_products_url_add = '{$link->getModuleLink('favoriteproducts', 'actions', ['process' => 'add'], false)|escape:'html'}';
-	var favorite_products_url_remove = '{$link->getModuleLink('favoriteproducts', 'actions', ['process' => 'remove'], false)}';
+	var favorite_products_url_remove = '{$link->getModuleLink('favoriteproducts', 'actions', ['process' => 'remove'], false)|escape:'html'}';
 {if isset($smarty.get.id_product)}
 	var favorite_products_id_product = '{$smarty.get.id_product|intval}';
 {/if} 

modules/homefeatured/homefeatured.tpl

@@ -38,16 +38,16 @@
 				{math equation="(total%perLine)" total=$smarty.foreach.homeFeaturedProducts.total perLine=$nbItemsPerLine assign=totModulo}
 				{if $totModulo == 0}{assign var='totModulo' value=$nbItemsPerLine}{/if}
 				<li class="ajax_block_product {if $smarty.foreach.homeFeaturedProducts.first}first_item{elseif $smarty.foreach.homeFeaturedProducts.last}last_item{else}item{/if} {if $smarty.foreach.homeFeaturedProducts.iteration%$nbItemsPerLine == 0}last_item_of_line{elseif $smarty.foreach.homeFeaturedProducts.iteration%$nbItemsPerLine == 1} {/if} {if $smarty.foreach.homeFeaturedProducts.iteration > ($smarty.foreach.homeFeaturedProducts.total - $totModulo)}last_line{/if}">
-					<a href="{$product.link}" title="{$product.name|escape:html:'UTF-8'}" class="product_image"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'home_default')}" height="{$homeSize.height}" width="{$homeSize.width}" alt="{$product.name|escape:html:'UTF-8'}" />{if isset($product.new) && $product.new == 1}<span class="new">{l s='New' mod='homefeatured'}</span>{/if}</a>
+					<a href="{$product.link|escape:'html'}" title="{$product.name|escape:html:'UTF-8'}" class="product_image"><img src="{$link->getImageLink($product.link_rewrite, $product.id_image, 'home_default')|escape:'html'}" height="{$homeSize.height}" width="{$homeSize.width}" alt="{$product.name|escape:html:'UTF-8'}" />{if isset($product.new) && $product.new == 1}<span class="new">{l s='New' mod='homefeatured'}</span>{/if}</a>
-					<h5 class="s_title_block"><a href="{$product.link}" title="{$product.name|truncate:50:'...'|escape:'htmlall':'UTF-8'}">{$product.name|truncate:35:'...'|escape:'htmlall':'UTF-8'}</a></h5>
+					<h5 class="s_title_block"><a href="{$product.link|escape:'html'}" title="{$product.name|truncate:50:'...'|escape:'htmlall':'UTF-8'}">{$product.name|truncate:35:'...'|escape:'htmlall':'UTF-8'}</a></h5>
-					<div class="product_desc"><a href="{$product.link}" title="{l s='More' mod='homefeatured'}">{$product.description_short|strip_tags|truncate:65:'...'}</a></div>
+					<div class="product_desc"><a href="{$product.link|escape:'html'}" title="{l s='More' mod='homefeatured'}">{$product.description_short|strip_tags|truncate:65:'...'}</a></div>
 					<div>
-						<a class="lnk_more" href="{$product.link}" title="{l s='View' mod='homefeatured'}">{l s='View' mod='homefeatured'}</a>
+						<a class="lnk_more" href="{$product.link|escape:'html'}" title="{l s='View' mod='homefeatured'}">{l s='View' mod='homefeatured'}</a>
 						{if $product.show_price AND !isset($restricted_country_mode) AND !$PS_CATALOG_MODE}<p class="price_container"><span class="price">{if !$priceDisplay}{convertPrice price=$product.price}{else}{convertPrice price=$product.price_tax_exc}{/if}</span></p>{else}<div style="height:21px;"></div>{/if}
 						
 						{if ($product.id_product_attribute == 0 OR (isset($add_prod_display) AND ($add_prod_display == 1))) AND $product.available_for_order AND !isset($restricted_country_mode) AND $product.minimal_quantity == 1 AND $product.customizable != 2 AND !$PS_CATALOG_MODE}
 							{if ($product.quantity > 0 OR $product.allow_oosp)}
-							<a class="exclusive ajax_add_to_cart_button" rel="ajax_id_product_{$product.id_product}" href="{$link->getPageLink('cart')}?qty=1&amp;id_product={$product.id_product}&amp;token={$static_token}&amp;add" title="{l s='Add to cart' mod='homefeatured'}">{l s='Add to cart' mod='homefeatured'}</a>
+							<a class="exclusive ajax_add_to_cart_button" rel="ajax_id_product_{$product.id_product}" href="{$link->getPageLink('cart')|escape:'html'}?qty=1&amp;id_product={$product.id_product}&amp;token={$static_token}&amp;add" title="{l s='Add to cart' mod='homefeatured'}">{l s='Add to cart' mod='homefeatured'}</a>
 							{else}
 							<span class="exclusive">{l s='Add to cart' mod='homefeatured'}</span>
 							{/if}

modules/homeslider/homeslider.tpl

@@ -46,7 +46,7 @@ var homeslider_pause = {$homeslider.pause};
 	{if $slide.active}
 		<li>
 			<a href="{$slide.url|escape:'htmlall':'UTF-8'}" title="{$slide.description|escape:'htmlall':'UTF-8'}">
-			<img src="{$smarty.const._MODULE_DIR_}/homeslider/images/{$slide.image|escape:'htmlall':'UTF-8'}" alt="{$slide.legend|escape:'htmlall':'UTF-8'}" height="{$homeslider.height|intval}" width="{$homeslider.width|intval}" />
+			<img src="{$smarty.const._MODULE_DIR_}homeslider/images/{$slide.image|escape:'htmlall':'UTF-8'}" alt="{$slide.legend|escape:'htmlall':'UTF-8'}" height="{$homeslider.height|intval}" width="{$homeslider.width|intval}" />
 			</a>
 		</li>
 	{/if}

modules/loyalty/LoyaltyModule.php

@@ -197,20 +197,23 @@ class LoyaltyModule extends ObjectModel
 		if (!Validate::isLoadedObject($cartRule))
 			die(Tools::displayError('Incorrect object CartRule.'));
 		$items = self::getAllByIdCustomer((int)$cartRule->id_customer, NULL, true);
+		$associated = false;
 		foreach ($items AS $item)
 		{
-			$f = new LoyaltyModule((int)$item['id_loyalty']);
+			$lm = new LoyaltyModule((int)$item['id_loyalty']);
 			
 			/* Check for negative points for this order */
 			$negativePoints = (int)Db::getInstance()->getValue('SELECT SUM(points) points FROM '._DB_PREFIX_.'loyalty WHERE id_order = '.(int)$f->id_order.' AND id_loyalty_state = '.(int)LoyaltyStateModule::getCancelId().' AND points < 0');
 			
-			if ($f->points + $negativePoints <= 0)
+			if ($lm->points + $negativePoints <= 0)
 				continue;
 			
-			$f->id_cart_rule = (int)$cartRule->id;
+			$lm->id_cart_rule = (int)$cartRule->id;
-			$f->id_loyalty_state = (int)LoyaltyStateModule::getConvertId();
+			$lm->id_loyalty_state = (int)LoyaltyStateModule::getConvertId();
-			$f->save();
+			$lm->save();
+			$associated = true;
 		}
+		return $associated;
 	}
 
 	public static function getOrdersByIdDiscount($id_cart_rule)

modules/loyalty/controllers/front/default.php

@@ -112,10 +112,11 @@ class LoyaltyDefaultModuleFrontController extends ModuleFrontController
 				$cart_rule->add();
 
 			// Register order(s) which contributed to create this voucher
-			LoyaltyModule::registerDiscount($cart_rule);
+			if (!LoyaltyModule::registerDiscount($cart_rule))
-
+				$cart_rule->delete();
-			Tools::redirect($this->context->link->getModuleLink('loyalty', 'default', array('process' => 'summary')));
 		}
+
+		Tools::redirect($this->context->link->getModuleLink('loyalty', 'default', array('process' => 'summary')));
 	}
 
 	/**

modules/loyalty/loyalty-program.php

@@ -42,7 +42,7 @@ if (!$context->customer->isLogged())
 
 $context->controller->addJqueryPlugin(array('dimensions', 'cluetip'));
 
-$customerPoints = (int)(LoyaltyModule::getPointsByCustomer((int)($cookie->id_customer)));
+$customerPoints = (int)LoyaltyModule::getPointsByCustomer((int)$cookie->id_customer);
 
 /* transform point into voucher if needed */
 if (Tools::getValue('transform-points') == 'true' AND $customerPoints > 0)
@@ -99,7 +99,8 @@ if (Tools::getValue('transform-points') == 'true' AND $customerPoints > 0)
 		$cartRule->add();
 
 	/* Register order(s) which contributed to create this voucher */
-	LoyaltyModule::registerDiscount($cartRule);
+	if (!LoyaltyModule::registerDiscount($cartRule))
+		$cartRule->delete();
 
 	Tools::redirect('modules/loyalty/loyalty-program.php');
 }

modules/loyalty/loyalty.php

@@ -36,6 +36,8 @@ if (!defined('_PS_VERSION_'))
 	
 class Loyalty extends Module
 {
+	protected $html = '';
+	
 	public function __construct()
 	{
 		$this->name = 'loyalty';
@@ -219,16 +221,15 @@ class Loyalty extends Module
 					$this->loyaltyStateNoneAward->name[$id_lang_default] = ' ';
 				$this->loyaltyStateNoneAward->save();
 
-				echo $this->displayConfirmation($this->l('Settings updated.'));
+				$this->html .= $this->displayConfirmation($this->l('Settings updated.'));
 			}
 			else
 			{
 				$errors = '';
 				foreach ($this->_errors as $error)
 					$errors .= $error.'<br />';
-				echo $this->displayError($errors);
+				$this->html .= $this->displayError($errors);
 			}
-//            redirect($this->context->link);
 		}
 	}
 
@@ -252,7 +253,7 @@ class Loyalty extends Module
 		$languages = Language::getLanguages(false);
 		$languageIds = 'voucher_details¤default_loyalty_state¤none_award_loyalty_state¤convert_loyalty_state¤validation_loyalty_state¤cancel_loyalty_state';
 
-		$html = '
+		$this->html .= '
 		<script type="text/javascript">
 			id_language = Number('.$id_lang_default.');
 		</script>
@@ -274,12 +275,12 @@ class Loyalty extends Module
 				<label>'.$this->l('Voucher details').'</label>
 				<div class="margin-form">';
 		foreach ($languages as $language)
-			$html .= '
+			$this->html .= '
 					<div id="voucher_details_'.$language['id_lang'].'" style="display: '.($language['id_lang'] == $id_lang_default ? 'block' : 'none').'; float: left;">
 						<input size="33" type="text" name="voucher_details_'.$language['id_lang'].'" value="'.Configuration::get('PS_LOYALTY_VOUCHER_DETAILS', (int)($language['id_lang'])).'" />
 					</div>';
-		$html .= $this->displayFlags($languages, $id_lang_default, $languageIds, 'voucher_details', true);
+		$this->html .= $this->displayFlags($languages, $id_lang_default, $languageIds, 'voucher_details', true);
-		$html .= '	</div>
+		$this->html .= '	</div>
 				<div class="clear" style="margin-top: 20px"></div>
 				<label>'.$this->l('Minimum amount in which the voucher can be used').'</label>
 				<div class="margin-form">
@@ -299,12 +300,12 @@ class Loyalty extends Module
 					<select id="id_order_state_validation" name="id_order_state_validation">';
 		foreach ($order_states as $order_state)
 		{
-			$html .= '<option value="'.$order_state['id_order_state'].'" style="background-color:'.$order_state['color'].';"';
+			$this->html .= '<option value="'.$order_state['id_order_state'].'" style="background-color:'.$order_state['color'].';"';
 			if ((int)$this->loyaltyStateValidation->id_order_state == $order_state['id_order_state'])
-				$html .= ' selected="selected"';
+				$this->html .= ' selected="selected"';
-			$html .= '>'.$order_state['name'].'</option>';
+			$this->html .= '>'.$order_state['name'].'</option>';
 		}
-		$html .= '</select>
+		$this->html .= '</select>
 				</div>
 				<div class="clear"></div>
 				<label>'.$this->l('Points are cancelled when the order is').'</label>
@@ -312,12 +313,12 @@ class Loyalty extends Module
 					<select id="id_order_state_cancel" name="id_order_state_cancel">';
 		foreach ($order_states as $order_state)
 		{
-			$html .= '<option value="'.$order_state['id_order_state'].'" style="background-color:'.$order_state['color'].';"';
+			$this->html .= '<option value="'.$order_state['id_order_state'].'" style="background-color:'.$order_state['color'].';"';
 			if ((int)$this->loyaltyStateCancel->id_order_state == $order_state['id_order_state'])
-				$html .= ' selected="selected"';
+				$this->html .= ' selected="selected"';
-			$html .= '>'.$order_state['name'].'</option>';
+			$this->html .= '>'.$order_state['name'].'</option>';
 		}
-		$html .= '</select>
+		$this->html .= '</select>
 				</div>
 				<div class="clear"></div>
 				<label>'.$this->l('Vouchers created by the loyalty system can be used in the following categories :').'</label>';
@@ -325,67 +326,67 @@ class Loyalty extends Module
 		$indexedCategories = isset($_POST['categoryBox']) ? $_POST['categoryBox'] : $index;
 
 		$helper = new Helper();
-		$html .= '<div class="margin-form">'.$helper->renderCategoryTree(null, $indexedCategories).'</div>';
+		$this->html .= '<div class="margin-form">'.$helper->renderCategoryTree(null, $indexedCategories).'</div>';
-		$html .= '
+		$this->html .= '
 				<p style="padding-left:200px;">'.$this->l('Mark the box(es) of categories in which loyalty vouchers are usable.').'</p>
 				<div class="clear"></div>
 				<h3 style="margin-top:20px">'.$this->l('Loyalty points progression').'</h3>
 				<label>'.$this->l('Initial').'</label>
 				<div class="margin-form">';
 		foreach ($languages as $language)
-			$html .= '
+			$this->html .= '
 					<div id="default_loyalty_state_'.$language['id_lang'].'" style="display: '.($language['id_lang'] == $id_lang_default ? 'block' : 'none').'; float: left;">
 						<input size="33" type="text" name="default_loyalty_state_'.$language['id_lang'].'" value="'.(isset($this->loyaltyStateDefault->name[(int)($language['id_lang'])]) ? $this->loyaltyStateDefault->name[(int)($language['id_lang'])] : $this->loyaltyStateDefault->name[(int)$id_lang_default]).'" />
 					</div>';
-		$html .= $this->displayFlags($languages, $id_lang_default, $languageIds, 'default_loyalty_state', true);
+		$this->html .= $this->displayFlags($languages, $id_lang_default, $languageIds, 'default_loyalty_state', true);
-		$html .= '	</div>
+		$this->html .= '	</div>
 				<div class="clear"></div>
 				<label>'.$this->l('Unavailable').'</label>
 				<div class="margin-form">';
 		foreach ($languages as $language)
-			$html .= '
+			$this->html .= '
 					<div id="none_award_loyalty_state_'.$language['id_lang'].'" style="display: '.($language['id_lang'] == $id_lang_default ? 'block' : 'none').'; float: left;">
 						<input size="33" type="text" name="none_award_loyalty_state_'.$language['id_lang'].'" value="'.(isset($this->loyaltyStateNoneAward->name[(int)($language['id_lang'])]) ? $this->loyaltyStateNoneAward->name[(int)($language['id_lang'])] : $this->loyaltyStateNoneAward->name[(int)$id_lang_default]).'" />
 					</div>';
-		$html .= $this->displayFlags($languages, $id_lang_default, $languageIds, 'none_award_loyalty_state', true);
+		$this->html .= $this->displayFlags($languages, $id_lang_default, $languageIds, 'none_award_loyalty_state', true);
-		$html .= '	</div>
+		$this->html .= '	</div>
 				<div class="clear"></div>
 				<label>'.$this->l('Converted').'</label>
 				<div class="margin-form">';
 		foreach ($languages as $language)
-			$html .= '
+			$this->html .= '
 					<div id="convert_loyalty_state_'.$language['id_lang'].'" style="display: '.($language['id_lang'] == $id_lang_default ? 'block' : 'none').'; float: left;">
 						<input size="33" type="text" name="convert_loyalty_state_'.$language['id_lang'].'" value="'.(isset($this->loyaltyStateConvert->name[(int)($language['id_lang'])]) ? $this->loyaltyStateConvert->name[(int)($language['id_lang'])] : $this->loyaltyStateConvert->name[(int)$id_lang_default]).'" />
 					</div>';
-		$html .= $this->displayFlags($languages, $id_lang_default, $languageIds, 'convert_loyalty_state', true);
+		$this->html .= $this->displayFlags($languages, $id_lang_default, $languageIds, 'convert_loyalty_state', true);
-		$html .= '	</div>
+		$this->html .= '	</div>
 				<div class="clear"></div>
 				<label>'.$this->l('Validation').'</label>
 				<div class="margin-form">';
 		foreach ($languages as $language)
-			$html .= '
+			$this->html .= '
 					<div id="validation_loyalty_state_'.$language['id_lang'].'" style="display: '.($language['id_lang'] == $id_lang_default ? 'block' : 'none').'; float: left;">
 						<input size="33" type="text" name="validation_loyalty_state_'.$language['id_lang'].'" value="'.(isset($this->loyaltyStateValidation->name[(int)($language['id_lang'])]) ? $this->loyaltyStateValidation->name[(int)($language['id_lang'])] : $this->loyaltyStateValidation->name[(int)$id_lang_default]).'" />
 					</div>';
-		$html .= $this->displayFlags($languages, $id_lang_default, $languageIds, 'validation_loyalty_state', true);
+		$this->html .= $this->displayFlags($languages, $id_lang_default, $languageIds, 'validation_loyalty_state', true);
-		$html .= '	</div>
+		$this->html .= '	</div>
 				<div class="clear"></div>
 				<label>'.$this->l('Cancelled').'</label>
 				<div class="margin-form">';
 		foreach ($languages as $language)
-			$html .= '
+			$this->html .= '
 					<div id="cancel_loyalty_state_'.$language['id_lang'].'" style="display: '.($language['id_lang'] == $id_lang_default ? 'block' : 'none').'; float: left;">
 						<input size="33" type="text" name="cancel_loyalty_state_'.$language['id_lang'].'" value="'.(isset($this->loyaltyStateCancel->name[(int)($language['id_lang'])]) ? $this->loyaltyStateCancel->name[(int)($language['id_lang'])] : $this->loyaltyStateCancel->name[(int)$id_lang_default]).'" />
 					</div>';
-		$html .= $this->displayFlags($languages, $id_lang_default, $languageIds, 'cancel_loyalty_state', true);
+		$this->html .= $this->displayFlags($languages, $id_lang_default, $languageIds, 'cancel_loyalty_state', true);
-		$html .= '	</div>
+		$this->html .= '	</div>
 				<div class="clear center">
 					<input type="submit" style="margin-top:20px" name="submitLoyalty" id="submitLoyalty" value="'.$this->l('   Save   ').'" class="button" />
 				</div>
 			</fieldset>
 		</form>';
 
-		return $html;
+		return $this->html;
 	}
 
 	public static function recurseCategoryForInclude($id_obj, $indexedCategories, $categories, $current, $id_category = 1, $id_category_default = null, $has_suite = array())

modules/loyalty/views/templates/front/loyalty.tpl

@@ -23,7 +23,7 @@
 *  International Registered Trademark & Property of PrestaShop SA
 *}
 
-{capture name=path}<a href="{$link->getPageLink('my-account', true)}" title="{l s='Manage my account' mod='loyalty'}" rel="nofollow">{l s='My account' mod='loyalty'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='My loyalty points' mod='loyalty'}{/capture}
+{capture name=path}<a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='Manage my account' mod='loyalty'}" rel="nofollow">{l s='My account' mod='loyalty'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='My loyalty points' mod='loyalty'}{/capture}
 
 {include file="$tpl_dir./breadcrumb.tpl"}
 
@@ -125,7 +125,7 @@
 
 {if $transformation_allowed}
 <p style="text-align:center; margin-top:20px">
-	<a href="{$link->getModuleLink('loyalty', 'default', ['process' => 'transformpoints'])}" onclick="return confirm('{l s='Are you sure you want to transform your points into vouchers?' mod='loyalty' js=1}');">{l s='Transform my points into a voucher of' mod='loyalty'} <span class="price">{convertPrice price=$voucher}</span>.</a>
+	<a href="{$link->getModuleLink('loyalty', 'default', ['process' => 'transformpoints'])|escape:'html'}" onclick="return confirm('{l s='Are you sure you want to transform your points into vouchers?' mod='loyalty' js=1}');">{l s='Transform my points into a voucher of' mod='loyalty'} <span class="price">{convertPrice price=$voucher}</span>.</a>
 </p>
 {/if}
 
@@ -167,9 +167,9 @@
 				<td class="history_method">
 					<a href="{$smarty.server.SCRIPT_NAME|escape:'htmlall':'UTF-8'}" onclick="return false" class="tips" title="
 					{l s='Generated by these following orders' mod='loyalty'}|{foreach from=$discount->orders item=myorder name=myLoop}
-					{l s='Order #%d' sprintf=$myorder.id_order mod='loyalty'}
+					{$myorder.id_order|string_format:{l s='Order #%d' mod='loyalty'}}
 					({displayPrice price=$myorder.total_paid currency=$myorder.id_currency}) :
-					{if $myorder.points > 0}{l s='%d points.' sprintf=$myorder.points mod='loyalty'}{else}{l s='Cancelled' mod='loyalty'}{/if}
+					{if $myorder.points > 0}{$myorder.points|string_format:{l s='%d points.' mod='loyalty'}}{else}{l s='Cancelled' mod='loyalty'}{/if}
 					{if !$smarty.foreach.myLoop.last}|{/if}{/foreach}" rel="nofollow">{l s='more...' mod='loyalty'}</a></td>
 			</tr>
 		{/foreach}
@@ -205,8 +205,8 @@ $(document).ready(function()
 
 <ul class="footer_links">
 	<li>
-		<a href="{$link->getPageLink('my-account', true)}" title="{l s='Back to Your Account' mod='loyalty'}" rel="nofollow"><img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /></a>
+		<a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='Back to Your Account' mod='loyalty'}" rel="nofollow"><img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /></a>
-		<a href="{$link->getPageLink('my-account', true)}" title="{l s='Back to Your Account' mod='loyalty'}" rel="nofollow">{l s='Back to Your Account' mod='loyalty'}</a>
+		<a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='Back to Your Account' mod='loyalty'}" rel="nofollow">{l s='Back to Your Account' mod='loyalty'}</a>
 	</li>
 	<li class="f_right">
 		<a href="{$base_dir}" title="{l s='Home' mod='loyalty'}"><img src="{$img_dir}icon/home.gif" alt="" class="icon" /></a>

modules/loyalty/views/templates/hook/my-account.tpl

@@ -25,7 +25,7 @@
 
 <!-- MODULE Loyalty -->
 <li class="loyalty">
-	<a href="{$link->getModuleLink('loyalty', 'default', ['process' => 'summary'])}" title="{l s='My loyalty points' mod='loyalty'}" rel="nofollow">
+	<a href="{$link->getModuleLink('loyalty', 'default', ['process' => 'summary'])|escape:'html'}" title="{l s='My loyalty points' mod='loyalty'}" rel="nofollow">
 		<img src="{$module_template_dir}images/loyalty.gif" alt="{l s='My loyalty points' mod='loyalty'}" class="icon" /> {l s='My loyalty points' mod='loyalty'}
 	</a>
 </li>

modules/mailalerts/views/templates/front/mailalerts-account.tpl

@@ -35,7 +35,7 @@ $('document').ready(function()
 		var parent = $(this).parent().parent();
 
 		$.ajax({
-			url: "{$link->getModuleLink('mailalerts', 'actions', ['process' => 'remove'])}",
+			url: "{$link->getModuleLink('mailalerts', 'actions', ['process' => 'remove'])|escape:'html'}",
 			type: "POST",
 			data: {
 				'id_product': id_product_mail_alert,
@@ -56,7 +56,7 @@ $('document').ready(function()
 });
 </script>
 
-{capture name=path}<a href="{$link->getPageLink('my-account', true)}" title="{l s='Manage my account' mod='mailalerts'}" rel="nofollow">{l s='My account' mod='mailalerts'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='My alerts' mod='mailalerts'}{/capture}
+{capture name=path}<a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='Manage my account' mod='mailalerts'}" rel="nofollow">{l s='My account' mod='mailalerts'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='My alerts' mod='mailalerts'}{/capture}
 {include file="$tpl_dir./breadcrumb.tpl"}
 
 <div id="mailalerts_block_account">
@@ -65,8 +65,8 @@ $('document').ready(function()
 		<div>
 			{foreach from=$mailAlerts item=mailAlert}
 			<div class="mailalert clearfix">
-				<a href="{$link->getProductLink($mailAlert.id_product, null, null, null, null, $mailAlert.id_shop)}" title="{$mailAlert.name|escape:'htmlall':'UTF-8'}" class="product_img_link"><img src="{$link->getImageLink($mailAlert.link_rewrite, $mailAlert.cover, 'small_default')}" alt=""/></a>
+				<a href="{$link->getProductLink($mailAlert.id_product, null, null, null, null, $mailAlert.id_shop)}" title="{$mailAlert.name|escape:'htmlall':'UTF-8'}" class="product_img_link"><img src="{$link->getImageLink($mailAlert.link_rewrite, $mailAlert.cover, 'small_default')|escape:'html'}" alt=""/></a>
-				<h3><a href="{$link->getProductLink($mailAlert.id_product, null, null, null, null, $mailAlert.id_shop)}" title="{$mailAlert.name|escape:'htmlall':'UTF-8'}">{$mailAlert.name|escape:'htmlall':'UTF-8'}</a></h3>
+				<h3><a href="{$link->getProductLink($mailAlert.id_product, null, null, null, null, $mailAlert.id_shop)|escape:'html'}" title="{$mailAlert.name|escape:'htmlall':'UTF-8'}">{$mailAlert.name|escape:'htmlall':'UTF-8'}</a></h3>
 				<div class="product_desc">{$mailAlert.attributes_small|escape:'htmlall':'UTF-8'}</div>
 
 				<div class="remove">
@@ -80,6 +80,6 @@ $('document').ready(function()
 	{/if}
 
 	<ul class="footer_links">
-		<li class="fleft"><a href="{$link->getPageLink('my-account', true)}" rel="nofollow"><img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /></a><a href="{$link->getPageLink('my-account', true)}" title="{l s='Back to Your Account' mod='mailalerts'}">{l s='Back to Your Account' mod='mailalerts'}</a></li>
+		<li class="fleft"><a href="{$link->getPageLink('my-account', true)}" rel="nofollow"><img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /></a><a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='Back to Your Account' mod='mailalerts'}">{l s='Back to Your Account' mod='mailalerts'}</a></li>
 	</ul>
 </div>

modules/mailalerts/views/templates/hook/my-account.tpl

@@ -24,7 +24,7 @@
 *}
 
 <li class="mailalerts">
-	<a href="{$link->getModuleLink('mailalerts', 'account')}" title="{l s='My alerts' mod='mailalerts'}" rel="nofollow">
+	<a href="{$link->getModuleLink('mailalerts', 'account')|escape:'html'}" title="{l s='My alerts' mod='mailalerts'}" rel="nofollow">
 		<img src="{$module_template_dir}img/icon-alert.png" class="icon" />
 		{l s='My alerts' mod='mailalerts'}
 	</a>

modules/productcomments/productcomments.tpl

@@ -89,7 +89,7 @@ var productcomments_url_rewrite = '{$productcomments_url_rewriting_activated}';
 		<form action="#">
 			<h2 class="title">{l s='Write your review' mod='productcomments'}</h2>
 			<div class="product clearfix">
-				<img src="{$link->getImageLink($product->link_rewrite, $productcomment_cover, 'home_default')}" height="{$homeSize.height}" width="{$homeSize.width}" alt="{$product->name|escape:html:'UTF-8'}" />
+				<img src="{$link->getImageLink($product->link_rewrite, $productcomment_cover, 'home_default')|escape:'html'}" height="{$homeSize.height}" width="{$homeSize.width}" alt="{$product->name|escape:html:'UTF-8'}" />
 				<div class="product_desc">
 					<p class="product_name"><strong>{$product->name}</strong></p>
 					{$product->description_short}

modules/productscategory/productscategory.tpl

@@ -32,9 +32,9 @@
 		<ul {if count($categoryProducts) > 5}style="width: {math equation="width * nbImages" width=107 nbImages=$categoryProducts|@count}px"{/if}>
 			{foreach from=$categoryProducts item='categoryProduct' name=categoryProduct}
 			<li {if count($categoryProducts) < 6}style="width:60px"{/if}>
-				<a href="{$link->getProductLink($categoryProduct.id_product, $categoryProduct.link_rewrite, $categoryProduct.category, $categoryProduct.ean13)}" class="lnk_img" title="{$categoryProduct.name|htmlspecialchars}"><img src="{$link->getImageLink($categoryProduct.link_rewrite, $categoryProduct.id_image, 'medium_default')}" alt="{$categoryProduct.name|htmlspecialchars}" /></a>
+				<a href="{$link->getProductLink($categoryProduct.id_product, $categoryProduct.link_rewrite, $categoryProduct.category, $categoryProduct.ean13)}" class="lnk_img" title="{$categoryProduct.name|htmlspecialchars}"><img src="{$link->getImageLink($categoryProduct.link_rewrite, $categoryProduct.id_image, 'medium_default')|escape:'html'}" alt="{$categoryProduct.name|htmlspecialchars}" /></a>
 				<p class="product_name">
-					<a href="{$link->getProductLink($categoryProduct.id_product, $categoryProduct.link_rewrite, $categoryProduct.category, $categoryProduct.ean13)}" title="{$categoryProduct.name|htmlspecialchars}">{$categoryProduct.name|truncate:14:'...'|escape:'htmlall':'UTF-8'}</a>
+					<a href="{$link->getProductLink($categoryProduct.id_product, $categoryProduct.link_rewrite, $categoryProduct.category, $categoryProduct.ean13)|escape:'html'}" title="{$categoryProduct.name|htmlspecialchars}">{$categoryProduct.name|truncate:14:'...'|escape:'htmlall':'UTF-8'}</a>
 				</p>
 				{if $ProdDisplayPrice AND $categoryProduct.show_price == 1 AND !isset($restricted_country_mode) AND !$PS_CATALOG_MODE}
 				<p class="price_display">

modules/pscleaner/pscleaner.php

@@ -49,7 +49,7 @@ class PSCleaner extends Module
 	{
 		$html = '<h2>'.$this->l('Be really careful with this tool - There is no possible rollback!').'</h2>';
 		if (Tools::isSubmit('submitCheckAndFix'))
-			$html .= (count($logs = self::checkAndFix()) ? print_r($logs, true) : $this->l('Nothing that need to be cleaned')).'<br /><br />';
+			$html .= $this->displayConfirmation((count($logs = self::checkAndFix()) ? '<pre>'.print_r($logs, true).'</pre>' : $this->l('Nothing that need to be cleaned')).'<br /><br />');
 		if (Tools::isSubmit('submitTruncateCatalog'))
 		{
 			self::truncate('catalog');
@@ -291,7 +291,7 @@ class PSCleaner extends Module
 		}
 
 		// _lang table cleaning
-		$tables = Db::getInstance()->executeS('SHOW TABLES LIKE "'._DB_PREFIX_.'%_\\_lang"');
+		$tables = Db::getInstance()->executeS('SHOW TABLES LIKE "'.preg_replace('/([%_])/', '\\$1', _DB_PREFIX_).'%_\\_lang"');
 		foreach ($tables as $table)
 		{
 			$table_lang = current($table);
@@ -310,7 +310,7 @@ class PSCleaner extends Module
 		}
 		
 		// _shop table cleaning
-		$tables = Db::getInstance()->executeS('SHOW TABLES LIKE "'._DB_PREFIX_.'%_\\_shop"');
+		$tables = Db::getInstance()->executeS('SHOW TABLES LIKE "'.preg_replace('/([%_])/', '\\$1', _DB_PREFIX_).'%_\\_shop"');
 		foreach ($tables as $table)
 		{
 			$table_shop = current($table);
@@ -348,9 +348,9 @@ class PSCleaner extends Module
 			case 'catalog':
 				$id_home = Configuration::get('PS_HOME_CATEGORY');
 				$id_root = Configuration::get('PS_ROOT_CATEGORY');
-				Db::getInstance()->execute('DELETE FROM `'._DB_PREFIX_.'category` WHERE id_category NOT IN ('.(int)$id_home.', '.(int)$id_root.')');
+				$db->execute('DELETE FROM `'._DB_PREFIX_.'category` WHERE id_category NOT IN ('.(int)$id_home.', '.(int)$id_root.')');
-				Db::getInstance()->execute('DELETE FROM `'._DB_PREFIX_.'category_lang` WHERE id_category NOT IN ('.(int)$id_home.', '.(int)$id_root.')');
+				$db->execute('DELETE FROM `'._DB_PREFIX_.'category_lang` WHERE id_category NOT IN ('.(int)$id_home.', '.(int)$id_root.')');
-				Db::getInstance()->execute('DELETE FROM `'._DB_PREFIX_.'category_shop` WHERE id_category NOT IN ('.(int)$id_home.', '.(int)$id_root.')');
+				$db->execute('DELETE FROM `'._DB_PREFIX_.'category_shop` WHERE id_category NOT IN ('.(int)$id_home.', '.(int)$id_root.')');
 				foreach (scandir(_PS_CAT_IMG_DIR_) as $dir)
 					if (preg_match('/^[0-9]+(\-(.*))?\.jpg$/', $dir))
 						unlink(_PS_CAT_IMG_DIR_.$dir);
@@ -475,8 +475,6 @@ class PSCleaner extends Module
 					'order_payment',
 					'order_return',
 					'order_return_detail',
-					'order_return_state',
-					'order_return_state_lang',
 					'order_slip',
 					'order_slip_detail',
 					'page',
@@ -494,9 +492,10 @@ class PSCleaner extends Module
 		$this->clearAllCaches();
 	}
 	
+	// Not called yet
 	public static function cleanAndOptimize()
 	{
-		// Clean (carts...)
+		Db::getInstance()->execute('DELETE FROM `'._DB_PREFIX_.'cart` WHERE id_cart NOT IN (SELECT id_cart FROM `'._DB_PREFIX_.'cart`) AND date_add < "'.pSQL(date('Y-m-d', strtotime('-1 month'))).'"');
 	}
 	
 	protected static function bulle($array)
@@ -508,16 +507,13 @@ class PSCleaner extends Module
 			$sorted = true;
 			for ($i = 0; $i < $size - 1; ++$i)
 				for ($j = $i + 1; $j < $size; ++$j)
-				{
 					if ($array[$i][2] == $array[$j][0])
 					{
-						// var_dump(array($array[$i], $array[$j]));
 						$tmp = $array[$i];
 						$array[$i] = $array[$j];
 						$array[$j] = $tmp;
 						$sorted = false;
 					}
-				}
 		}
 		return $array;
 	}

modules/referralprogram/views/templates/front/program.tpl

@@ -31,7 +31,7 @@
 	//]]>
 </script>
 
-{capture name=path}<a href="{$link->getPageLink('my-account', true)}" title="{l s='Manage my account' mod='referralprogram'}" rel="nofollow">{l s='My account' mod='referralprogram'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='Referral Program' mod='referralprogram'}{/capture}
+{capture name=path}<a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='Manage my account' mod='referralprogram'}" rel="nofollow">{l s='My account' mod='referralprogram'}</a><span class="navigation-pipe">{$navigationPipe}</span>{l s='Referral Program' mod='referralprogram'}{/capture}
 {include file="$tpl_dir./breadcrumb.tpl"}
 
 <h2>{l s='Referral program' mod='referralprogram'}</h2>
@@ -95,7 +95,7 @@
 				{/if},
 				{l s='he or she will receive a %1$d voucher and you will receive your own voucher worth %2$d.' sprintf=[$discount,$discount] mod='referralprogram'}
 			</p>
-			<form method="post" action="{$link->getModuleLink('referralprogram', 'program', [], true)}" class="std">
+			<form method="post" action="{$link->getModuleLink('referralprogram', 'program', [], true)|escape:'html'}" class="std">
 				<table class="std">
 				<thead>
 					<tr>
@@ -122,12 +122,12 @@
 				<p class="checkbox">
 					<input type="checkbox" name="conditionsValided" id="conditionsValided" value="1" {if isset($smarty.post.conditionsValided) AND $smarty.post.conditionsValided eq 1}checked="checked"{/if} />
 					<label for="conditionsValided">{l s='I agree to the terms of service and adhere to them unconditionally.' mod='referralprogram'}</label>
-					<a href="{$link->getModuleLink('referralprogram', 'rules', ['height' => '500', 'width' => '400'], true)}" class="thickbox" title="{l s='Conditions of the referral program' mod='referralprogram'}" rel="nofollow">{l s='Read conditions.' mod='referralprogram'}</a>
+					<a href="{$link->getModuleLink('referralprogram', 'rules', ['height' => '500', 'width' => '400'], true)|escape:'html'}" class="thickbox" title="{l s='Conditions of the referral program' mod='referralprogram'}" rel="nofollow">{l s='Read conditions.' mod='referralprogram'}</a>
 				</p>
 				<p class="see_email">
 					{l s='Preview' mod='referralprogram'} 
 					{assign var="file" value="{$lang_iso}/referralprogram-invitation.html"}
-					<a href="{$link->getModuleLink('referralprogram', 'email', ['height' => '500', 'width' => '600', 'mail' => {$file}], true)}" class="thickbox" title="{l s='Invitation e-mail' mod='referralprogram'}" rel="nofollow">{l s='the default e-mail' mod='referralprogram'}</a> {l s='that will be sent to your friend(s).' mod='referralprogram'}
+					<a href="{$link->getModuleLink('referralprogram', 'email', ['height' => '500', 'width' => '600', 'mail' => {$file}], true)|escape:'html'}" class="thickbox" title="{l s='Invitation e-mail' mod='referralprogram'}" rel="nofollow">{l s='the default e-mail' mod='referralprogram'}</a> {l s='that will be sent to your friend(s).' mod='referralprogram'}
 				</p>
 				<p class="submit">
 					<input type="submit" id="submitSponsorFriends" name="submitSponsorFriends" class="button_large" value="{l s='Validate' mod='referralprogram'}" />
@@ -145,7 +145,7 @@
 		<p>
 			{l s='These friends have not yet placed an order on this Website since you sponsored them, but you can try again! To do so, mark the checkboxes of the friend(s) you want to remind, then click on the button "Remind my friend(s)"' mod='referralprogram'}
 		</p>
-		<form method="post" action="{$link->getModuleLink('referralprogram', 'program', [], true)}" class="std">
+		<form method="post" action="{$link->getModuleLink('referralprogram', 'program', [], true)|escape:'html'}" class="std">
 			<table class="std">
 			<thead>
 				<tr>
@@ -218,7 +218,7 @@
 
 <ul class="footer_links">
 	<li>
-		<a href="{$link->getPageLink('my-account', true)}" title="{l s='Back to Your Account' mod='referralprogram'}" rel="nofollow">
+		<a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='Back to Your Account' mod='referralprogram'}" rel="nofollow">
 		<img src="{$img_dir}icon/my-account.gif" alt="" class="icon" /> {l s='Back to Your Account' mod='referralprogram'}</a>
 	</li>
 	<li class="f_right"><a href="{$base_dir}" title="{l s='Home' mod='referralprogram'}"><img src="{$img_dir}icon/home.gif" alt="" class="icon" /> {l s='Home' mod='referralprogram'}</a></li>

modules/referralprogram/views/templates/hook/my-account.tpl

@@ -25,7 +25,7 @@
 
 <!-- MODULE ReferralProgram -->
 <li class="referralprogram">
-	<a href="{$link->getModuleLink('referralprogram', 'program', [], true)}" title="{l s='Referral program' mod='referralprogram'}" rel="nofollow">
+	<a href="{$link->getModuleLink('referralprogram', 'program', [], true)|escape:'html'}" title="{l s='Referral program' mod='referralprogram'}" rel="nofollow">
 		<img src="{$module_template_dir}referralprogram.gif" alt="{l s='Referral program' mod='referralprogram'}" class="icon" /> 
 			{l s='Referral program' mod='referralprogram'}
 	</a>

modules/referralprogram/views/templates/hook/shopping-cart.tpl

@@ -28,7 +28,7 @@
 	<img src="{$module_template_dir}referralprogram.gif" alt="{l s='Referral program' mod='referralprogram'}" class="icon" />
 	{l s='You have earned a voucher worth %s thanks to your sponsor!' sprintf=$discount_display mod='referralprogram'}
 	{l s='Enter voucher name %s to receive the reduction on this order.' sprintf=$discount->name mod='referralprogram'}
-	<a href="{$link->getModuleLink('referralprogram', 'program', [], true)}" title="{l s='Referral program' mod='referralprogram'}" rel="nofollow">{l s='View your referral program.' mod='referralprogram'}</a>
+	<a href="{$link->getModuleLink('referralprogram', 'program', [], true)|escape:'html'}" title="{l s='Referral program' mod='referralprogram'}" rel="nofollow">{l s='View your referral program.' mod='referralprogram'}</a>
 </p>
 <br />
 <!-- END : MODULE ReferralProgram -->