From 718e907d5ed364852c704be348bdc28e0a404259 Mon Sep 17 00:00:00 2001
From: tDidierjean <thomas.didierjean@prestashop.com>
Date: Fri, 30 Mar 2012 14:50:33 +0000
Subject: [PATCH] [-] BO : fix #PSTEST-1117 - bad handling of UTF8 strings in
 templates

---
 .../template/controllers/accounting_configuration/content.tpl | 2 +-
 .../template/controllers/addresses/helpers/form/form.tpl      | 2 +-
 .../template/controllers/attribute_generator/content.tpl      | 2 +-
 .../controllers/attributes/helpers/list/list_content.tpl      | 2 +-
 .../default/template/controllers/cart_rules/actions.tpl       | 2 +-
 .../default/template/controllers/cart_rules/conditions.tpl    | 2 +-
 .../themes/default/template/controllers/login/content.tpl     | 2 +-
 .../controllers/maintenance/helpers/options/options.tpl       | 2 +-
 .../default/template/controllers/products/associations.tpl    | 4 ++--
 .../default/template/controllers/products/attachments.tpl     | 4 ++--
 .../default/template/controllers/products/combinations.tpl    | 4 ++--
 .../themes/default/template/controllers/products/features.tpl | 2 +-
 .../default/template/controllers/products/suppliers.tpl       | 2 +-
 .../default/template/controllers/products/warehouses.tpl      | 2 +-
 admin-dev/themes/default/template/header.tpl                  | 2 +-
 .../themes/default/template/helpers/list/list_content.tpl     | 2 +-
 admin-dev/themes/default/template/helpers/options/options.tpl | 2 +-
 controllers/admin/AdminSearchController.php                   | 2 +-
 18 files changed, 21 insertions(+), 21 deletions(-)

diff --git a/admin-dev/themes/default/template/controllers/accounting_configuration/content.tpl b/admin-dev/themes/default/template/controllers/accounting_configuration/content.tpl
index 627186eba..082019a10 100644
--- a/admin-dev/themes/default/template/controllers/accounting_configuration/content.tpl
+++ b/admin-dev/themes/default/template/controllers/accounting_configuration/content.tpl
@@ -46,7 +46,7 @@
 				<div style="clear: both; padding-top:15px;" id="conf_id_{$input_name}" >
 					<label class="conf_title">{$input['title']}</label>
 					{if $input['type'] == 'text'}
-						<input type="text" name="{$input_name|htmlentities}" {if isset($input['id'])}id="{$input['id']|htmlentities}"{/if} value="{$input['value']|htmlentities}" />
+						<input type="text" name="{$input_name|htmlentities}" {if isset($input['id'])}id="{$input['id']|htmlentities}"{/if} value="{$input['value']|escape:'htmlall':'UTF-8'}" />
 					{/if}
 					<div class="margin-form">
 						{if isset($input['desc'])}<p class="preference_description">{$input['desc']}</p>{/if}
diff --git a/admin-dev/themes/default/template/controllers/addresses/helpers/form/form.tpl b/admin-dev/themes/default/template/controllers/addresses/helpers/form/form.tpl
index 74f1c2e79..17ec54a67 100644
--- a/admin-dev/themes/default/template/controllers/addresses/helpers/form/form.tpl
+++ b/admin-dev/themes/default/template/controllers/addresses/helpers/form/form.tpl
@@ -86,7 +86,7 @@
 			});
 			</script>
 			<div class="margin-form">
-				<input type="text" size="33" name="email" value="{$fields_value[$input.name]|escape:'htmlall':'UTF-8'|htmlentities}" style="text-transform: lowercase;" /> <sup>*</sup>
+				<input type="text" size="33" name="email" value="{$fields_value[$input.name]|escape:'htmlall':'UTF-8'}" style="text-transform: lowercase;" /> <sup>*</sup>
 			</div>
 		{/if}
 	{else}
diff --git a/admin-dev/themes/default/template/controllers/attribute_generator/content.tpl b/admin-dev/themes/default/template/controllers/attribute_generator/content.tpl
index 4d6d0d820..1abccdeaf 100644
--- a/admin-dev/themes/default/template/controllers/attribute_generator/content.tpl
+++ b/admin-dev/themes/default/template/controllers/attribute_generator/content.tpl
@@ -109,7 +109,7 @@
 				</div>
 				<label>{l s='Reference'}</label>
 				<div class="margin-form">
-					<input type="text" size="20" name="reference" value="{$product_reference|htmlentities}"/>
+					<input type="text" size="20" name="reference" value="{$product_reference|escape:'htmlall':'UTF-8'}"/>
 				</div>
 			</div>
 			<div style="float:left; text-align:center; margin-left:20px;">
diff --git a/admin-dev/themes/default/template/controllers/attributes/helpers/list/list_content.tpl b/admin-dev/themes/default/template/controllers/attributes/helpers/list/list_content.tpl
index fe76d62b5..f9d43084c 100644
--- a/admin-dev/themes/default/template/controllers/attributes/helpers/list/list_content.tpl
+++ b/admin-dev/themes/default/template/controllers/attributes/helpers/list/list_content.tpl
@@ -91,7 +91,7 @@
 				{$tr.$key}
 			{* If type is 'editable', an input is created *}
 			{elseif isset($params.type) && $params.type == 'editable' && isset($tr.id)}
-				<input type="text" name="{$key}_{$tr.id}" value="{$tr.$key|htmlentities}" class="{$key}" />
+				<input type="text" name="{$key}_{$tr.id}" value="{$tr.$key|escape:'htmlall':'UTF-8'}" class="{$key}" />
 			{elseif isset($params.callback)}
 				{$tr.$key}
 			{elseif isset($tr.$key) && $key == 'color'}
diff --git a/admin-dev/themes/default/template/controllers/cart_rules/actions.tpl b/admin-dev/themes/default/template/controllers/cart_rules/actions.tpl
index 34204e42d..03aa39d6b 100644
--- a/admin-dev/themes/default/template/controllers/cart_rules/actions.tpl
+++ b/admin-dev/themes/default/template/controllers/cart_rules/actions.tpl
@@ -62,7 +62,7 @@
 		<label>{l s='Product'}</label>
 		<div class="margin-form">
 			<input type="hidden" id="reduction_product" name="reduction_product" value="{$currentTab->getFieldValue($currentObject, 'reduction_product')|intval}" />
-			<input type="text" id="reductionProductFilter" name="reductionProductFilter" value="{$reductionProductFilter|utf8_decode|htmlentities}" style="width:400px" />
+			<input type="text" id="reductionProductFilter" name="reductionProductFilter" value="{$reductionProductFilter|escape:'htmlall':'UTF-8'}" style="width:400px" />
 		</div>
 	</div>
 </div>
diff --git a/admin-dev/themes/default/template/controllers/cart_rules/conditions.tpl b/admin-dev/themes/default/template/controllers/cart_rules/conditions.tpl
index 0c310898d..d39859ba2 100644
--- a/admin-dev/themes/default/template/controllers/cart_rules/conditions.tpl
+++ b/admin-dev/themes/default/template/controllers/cart_rules/conditions.tpl
@@ -1,7 +1,7 @@
 <label>{l s='Limit to a single customer'}</label>
 <div class="margin-form">
 	<input type="hidden" id="id_customer" name="id_customer" value="{$currentTab->getFieldValue($currentObject, 'id_customer')|intval}" />
-	<input type="text" id="customerFilter" name="customerFilter" value="{$customerFilter|htmlentities}" style="width:400px" />
+	<input type="text" id="customerFilter" name="customerFilter" value="{$customerFilter|escape:'htmlall':'UTF-8'}" style="width:400px" />
 	<p class="preference_description">{l s='Optional, the cart rule will be available for everyone if you leave this field blank.'}</p>
 </div>
 <label>{l s='Validity'}</label>
diff --git a/admin-dev/themes/default/template/controllers/login/content.tpl b/admin-dev/themes/default/template/controllers/login/content.tpl
index 719d22a6a..b292595c9 100755
--- a/admin-dev/themes/default/template/controllers/login/content.tpl
+++ b/admin-dev/themes/default/template/controllers/login/content.tpl
@@ -53,7 +53,7 @@
 			<h1>{$shop_name}</h1>
 			<form action="" method="post" id="login_form" onsubmit="doAjaxLogin('{$redirect}');return false;">
 				<label for="email">{l s='E-mail address:'}</label><br />
-				<input type="text" id="email" name="email" class="input" value="{if isset($email)}{$email|htmlentities}{/if}" />
+				<input type="text" id="email" name="email" class="input" value="{if isset($email)}{$email|escape:'htmlall':'UTF-8'}{/if}" />
 				<div style="margin: 1.8em 0 0 0;">
 					<label for="passwd">{l s='Password:'}</label><br />
 					<input id="passwd" type="password" name="passwd" class="input" value="{if isset($password)}{$password}{/if}"/>
diff --git a/admin-dev/themes/default/template/controllers/maintenance/helpers/options/options.tpl b/admin-dev/themes/default/template/controllers/maintenance/helpers/options/options.tpl
index 6a15f2710..55a4930ac 100644
--- a/admin-dev/themes/default/template/controllers/maintenance/helpers/options/options.tpl
+++ b/admin-dev/themes/default/template/controllers/maintenance/helpers/options/options.tpl
@@ -28,7 +28,7 @@
 {block name="input"}
 	{if $field['type'] == 'maintenance_ip'}
 		{$field['script_ip']}
-		<input type="text"{if isset($field['id'])} id="{$field['id']}"{/if} size="{if isset($field['size'])}{$field['size']|intval}{else} 5{/if}" name="{$key}" value="{$field['value']|escape:'htmlall':'UTF-8'|htmlentities}" />
+		<input type="text"{if isset($field['id'])} id="{$field['id']}"{/if} size="{if isset($field['size'])}{$field['size']|intval}{else} 5{/if}" name="{$key}" value="{$field['value']|escape:'htmlall':'UTF-8'}" />
 		{$field['link_remove_ip']}
 	{else}
 		{$smarty.block.parent}
diff --git a/admin-dev/themes/default/template/controllers/products/associations.tpl b/admin-dev/themes/default/template/controllers/products/associations.tpl
index a3314948e..5915b0e31 100644
--- a/admin-dev/themes/default/template/controllers/products/associations.tpl
+++ b/admin-dev/themes/default/template/controllers/products/associations.tpl
@@ -78,7 +78,7 @@
 			<td class="col-left"><label>{l s='Accessories:'}</label></td>
 			<td style="padding-bottom:5px;">
 				<input type="hidden" name="inputAccessories" id="inputAccessories" value="{foreach from=$accessories item=accessory}{$accessory.id_product}-{/foreach}" />
-				<input type="hidden" name="nameAccessories" id="nameAccessories" value="{foreach from=$accessories item=accessory}{$accessory.name|htmlentitiesUTF8}¤{/foreach}" />
+				<input type="hidden" name="nameAccessories" id="nameAccessories" value="{foreach from=$accessories item=accessory}{$accessory.name|escape:'htmlall':'UTF-8'}¤{/foreach}" />
 
 				<div id="ajax_choose_product">
 					<p style="clear:both;margin-top:0;">
@@ -91,7 +91,7 @@
 				<div id="divAccessories">
 					{* @todo : donot use 3 foreach, but assign var *}
 					{foreach from=$accessories item=accessory}
-						{$accessory.name|htmlentitiesUTF8}{if !empty($accessory.reference)}{$accessory.reference}{/if} 
+						{$accessory.name|escape:'htmlall':'UTF-8'}{if !empty($accessory.reference)}{$accessory.reference}{/if}
 						<span onclick="delAccessory({$accessory.id_product});" style="cursor: pointer;">
 							<img src="../img/admin/delete.gif" class="middle" alt="" />
 						</span><br />
diff --git a/admin-dev/themes/default/template/controllers/products/attachments.tpl b/admin-dev/themes/default/template/controllers/products/attachments.tpl
index 6ef16a9a6..fe4293513 100644
--- a/admin-dev/themes/default/template/controllers/products/attachments.tpl
+++ b/admin-dev/themes/default/template/controllers/products/attachments.tpl
@@ -33,7 +33,7 @@
 		<div class="margin-form translatable">
 			{foreach $languages as $language}
 				<div class="lang_{$language.id_lang}" style="{if $language.id_lang != $default_form_language}display:none;{/if}float: left;">
-					<input type="text" name="attachment_name_{$language.id_lang}" value="{$attachment_name[$language.id_lang]|htmlentities}" />
+					<input type="text" name="attachment_name_{$language.id_lang}" value="{$attachment_name[$language.id_lang]|escape:'htmlall':'UTF-8'}" />
 				</div>
 			{/foreach}
 			<sup>&nbsp;*</sup>
@@ -44,7 +44,7 @@
 		<div class="margin-form translatable">
 			{foreach $languages as $language}
 				<div id="attachment_description_{$language.id_lang}" style="display: {if $language.id_lang == $default_form_language}block{else}none{/if}; float: left;">
-					<textarea name="attachment_description_{$language.id_lang}">{$attachment_description[$language.id_lang]|htmlentities}</textarea>
+					<textarea name="attachment_description_{$language.id_lang}">{$attachment_description[$language.id_lang]|escape:'htmlall':'UTF-8'}</textarea>
 				</div>
 			{/foreach}
 		</div>
diff --git a/admin-dev/themes/default/template/controllers/products/combinations.tpl b/admin-dev/themes/default/template/controllers/products/combinations.tpl
index e3df9d46a..bcacc8acf 100644
--- a/admin-dev/themes/default/template/controllers/products/combinations.tpl
+++ b/admin-dev/themes/default/template/controllers/products/combinations.tpl
@@ -66,7 +66,7 @@
 					<select name="attribute_group" id="attribute_group" style="width: 200px;" onchange="populate_attrs();">
 						{if isset($attributes_groups)}
 							{foreach from=$attributes_groups key=k item=attribute_group}
-								<option value="{$attribute_group.id_attribute_group}">{$attribute_group.name|htmlentitiesUTF8}&nbsp;&nbsp;</option>
+								<option value="{$attribute_group.id_attribute_group}">{$attribute_group.name|escape:'htmlall':'UTF-8'}&nbsp;&nbsp;</option>
 							{/foreach}
 						{/if}
 					</select>
@@ -288,7 +288,7 @@
 							<li style="float: left; width: {$imageWidth}px;">
 								<input type="checkbox" name="id_image_attr[]" value="{$image.id_image}" id="id_image_attr_{$image.id_image}" />
 								<label for="id_image_attr_{$image.id_image}" style="float: none;">
-									<img src="{$smarty.const._THEME_PROD_DIR_}{$image.obj->getExistingImgPath()}-small.jpg" alt="{$image.legend|htmlentitiesUTF8}" title="{$image.legend|htmlentitiesUTF8}" />
+									<img src="{$smarty.const._THEME_PROD_DIR_}{$image.obj->getExistingImgPath()}-small.jpg" alt="{$image.legend|escape:'htmlall':'UTF-8'}" title="{$image.legend|escape:'htmlall':'UTF-8'}" />
 								</label>
 							</li>
 						{/foreach}
diff --git a/admin-dev/themes/default/template/controllers/products/features.tpl b/admin-dev/themes/default/template/controllers/products/features.tpl
index 1d3a27441..c1475184c 100644
--- a/admin-dev/themes/default/template/controllers/products/features.tpl
+++ b/admin-dev/themes/default/template/controllers/products/features.tpl
@@ -81,7 +81,7 @@
 		{foreach from=$languages key=k item=language}
 			<div class="lang_{$language.id_lang}" style="{if $language.id_lang != $default_form_language}display:none;{/if}float: left;">
 			<textarea class="custom_{$available_feature.id_feature}_" name="custom_{$available_feature.id_feature}_{$language.id_lang}" cols="40" rows="1"
-				onkeyup="if (isArrowKey(event)) return ;$('#feature_{$available_feature.id_feature}_value').val(0);" >{$available_feature.val[$k].value|htmlentitiesUTF8|default:""}</textarea>
+				onkeyup="if (isArrowKey(event)) return ;$('#feature_{$available_feature.id_feature}_value').val(0);" >{$available_feature.val[$k].value|escape:'htmlall':'UTF-8'|default:""}</textarea>
 			</div>
 		{/foreach}
 		</td>
diff --git a/admin-dev/themes/default/template/controllers/products/suppliers.tpl b/admin-dev/themes/default/template/controllers/products/suppliers.tpl
index e356120a6..4ad19757c 100644
--- a/admin-dev/themes/default/template/controllers/products/suppliers.tpl
+++ b/admin-dev/themes/default/template/controllers/products/suppliers.tpl
@@ -106,7 +106,7 @@
 						<tr {if $index is odd}class="alt_row"{/if}>
 							<td>{$product_designation[$attribute['id_product_attribute']]}</td>
 							<td>
-								<input type="text" size="10" value="{$reference|htmlentities}" name="supplier_reference_{$attribute['id_product']}_{$attribute['id_product_attribute']}_{$supplier->id_supplier}" />
+								<input type="text" size="10" value="{$reference|escape:'htmlall':'UTF-8'}" name="supplier_reference_{$attribute['id_product']}_{$attribute['id_product_attribute']}_{$supplier->id_supplier}" />
 							</td>
 							<td>
 								<input type="text" size="10" value="{$price_te|htmlentities}" name="product_price_{$attribute['id_product']}_{$attribute['id_product_attribute']}_{$supplier->id_supplier}" />
diff --git a/admin-dev/themes/default/template/controllers/products/warehouses.tpl b/admin-dev/themes/default/template/controllers/products/warehouses.tpl
index bb0cf1046..41acf5298 100644
--- a/admin-dev/themes/default/template/controllers/products/warehouses.tpl
+++ b/admin-dev/themes/default/template/controllers/products/warehouses.tpl
@@ -67,7 +67,7 @@
 							<td>{$product_designation[$attribute['id_product_attribute']]}</td>
 							<td><input type="text"
 								name="location_warehouse_{$warehouse['id_warehouse']}_{$attribute['id_product']}_{$attribute['id_product_attribute']}"
-								value="{$location|htmlentities}"
+								value="{$location|escape:'htmlall':'UTF-8'}"
 								size="20" />
 							</td>
 						</tr>
diff --git a/admin-dev/themes/default/template/header.tpl b/admin-dev/themes/default/template/header.tpl
index 1e57a2fe6..f3b9295f8 100644
--- a/admin-dev/themes/default/template/header.tpl
+++ b/admin-dev/themes/default/template/header.tpl
@@ -155,7 +155,7 @@
 			</span>
 			<div id="header_search">
 				<form method="post" action="index.php?controller=AdminSearch&token={getAdminToken tab='AdminSearch'}">
-					<input type="text" name="bo_query" id="bo_query" value="{$bo_query|htmlentities}" />
+					<input type="text" name="bo_query" id="bo_query" value="{$bo_query}" />
 					<select name="bo_search_type" id="bo_search_type" class="chosen no-search">
 						<option value="0">{l s='everywhere'}</option>
 						<option value="1" {if {$search_type} == 1} selected="selected" {/if}>{l s='catalog'}</option>
diff --git a/admin-dev/themes/default/template/helpers/list/list_content.tpl b/admin-dev/themes/default/template/helpers/list/list_content.tpl
index 6380c715f..0a824148e 100644
--- a/admin-dev/themes/default/template/helpers/list/list_content.tpl
+++ b/admin-dev/themes/default/template/helpers/list/list_content.tpl
@@ -98,7 +98,7 @@
 					{$tr.$key} {l s='%'}
 				{* If type is 'editable', an input is created *}
 				{elseif isset($params.type) && $params.type == 'editable' && isset($tr.id)}
-					<input type="text" name="{$key}_{$tr.id}" value="{$tr.$key|htmlentities}" class="{$key}" />
+					<input type="text" name="{$key}_{$tr.id}" value="{$tr.$key|escape:'htmlall':'UTF-8'}" class="{$key}" />
 				{elseif isset($params.callback)}
 					{$tr.$key}
 				{elseif isset($tr.$key) && $key == 'color'}
diff --git a/admin-dev/themes/default/template/helpers/options/options.tpl b/admin-dev/themes/default/template/helpers/options/options.tpl
index 1b11da08e..b4ca5e1dd 100644
--- a/admin-dev/themes/default/template/helpers/options/options.tpl
+++ b/admin-dev/themes/default/template/helpers/options/options.tpl
@@ -134,7 +134,7 @@
 							{if $field['type'] == 'textLang'}
 								{foreach $field['languages'] AS $id_lang => $value}
 									<div id="{$key}_{$id_lang}" style="margin-bottom:8px; display: {if $id_lang == $current_id_lang}block{else}none{/if}; float: left; vertical-align: top;">
-										<input type="text" size="{if isset($field['size'])}{$field['size']|intval}{else}5{/if}" name="{$key}_{$id_lang}" value="{$value|htmlentities}" />
+										<input type="text" size="{if isset($field['size'])}{$field['size']|intval}{else}5{/if}" name="{$key}_{$id_lang}" value="{$value|escape:'htmlall':'UTF-8'}" />
 									</div>
 								{/foreach}
 							{elseif $field['type'] == 'textareaLang'}
diff --git a/controllers/admin/AdminSearchController.php b/controllers/admin/AdminSearchController.php
index 915968d52..966eceeca 100644
--- a/controllers/admin/AdminSearchController.php
+++ b/controllers/admin/AdminSearchController.php
@@ -234,7 +234,7 @@ class AdminSearchControllerCore extends AdminController
 
 	public function renderView()
 	{
-		$this->tpl_view_vars['query'] = $this->query;
+		$this->tpl_view_vars['query'] = Tools::safeOutput($this->query);
 		$this->tpl_view_vars['show_toolbar'] = true;
 
 		if (count($this->errors))