// Fix PSCFV-3933

admin-dev/themes/default/template/controllers/cart_rules/informations.tpl

@@ -6,7 +6,7 @@
 				<div class="translatable">
 				{foreach from=$languages item=language}
 					<div class="lang_{$language.id_lang|intval}" style="display:{if $language.id_lang == $id_lang_default}block{else}none{/if};float:left">
-						<input type="text" id="name_{$language.id_lang|intval}" name="name_{$language.id_lang|intval}" value="{$currentTab->getFieldValue($currentObject, 'name', $language.id_lang|intval)}" style="width:400px" />
+						<input type="text" id="name_{$language.id_lang|intval}" name="name_{$language.id_lang|intval}" value="{$currentTab->getFieldValue($currentObject, 'name', $language.id_lang|intval)|escape:html:'UTF-8'}" style="width:400px" />
 						<sup>*</sup>
 					</div>
 				{/foreach}

admin-dev/themes/default/template/controllers/products/helpers/form/form.tpl

@@ -237,7 +237,7 @@
 
 	<form id="product_form" action="{$form_action}" method="post" enctype="multipart/form-data" name="product" style="display:none;">
 		<input type="hidden" name="id_product" value="{$id_product}" />
-		<input type="hidden" id="is_virtual" name="is_virtual" value="{$product->is_virtual}" />
+		<input type="hidden" id="is_virtual" name="is_virtual" value="{$product->is_virtual|escape:html:'UTF-8'}" />
 		<div class="tab-pane" id="tabPane1">
 		{if !$product->active && $product->isAssociatedToShop()}
 			<div class="warn draft" >

admin-dev/themes/default/template/controllers/products/informations.tpl

@@ -136,7 +136,7 @@
 		<tr>
 			<td class="col-left"><label>{$bullet_common_field} {l s='UPC:'}</label></td>
 			<td style="padding-bottom:5px;">
-				<input size="55" maxlength="12" type="text" name="upc" value="{$product->upc}" style="width: 130px; margin-right: 5px;" /> <span class="small">{l s='(US, Canada)'}</span>
+				<input size="55" maxlength="12" type="text" name="upc" value="{$product->upc|escape:html:'UTF-8'}" style="width: 130px; margin-right: 5px;" /> <span class="small">{l s='(US, Canada)'}</span>
 			</td>
 		</tr>
 	</table>

admin-dev/themes/default/template/layout.tpl

@@ -42,7 +42,7 @@
 			<br/>
 			<ol>
 				{foreach $errors as $error}
-					<li>{$error}</li>
+					<li>{$error|escape:html:'UTF-8'}</li>
 				{/foreach}
 			</ol>
 		{/if}
@@ -52,7 +52,7 @@
 {if isset($informations) && count($informations) && $informations}
 	<div class="hint clear" style="display:block;">
 		{foreach $informations as $info}
-			{$info}<br />
+			{$info|escape:html:'UTF-8'}<br />
 		{/foreach}
 	</div><br />
 {/if}
@@ -60,7 +60,7 @@
 {if isset($confirmations) && count($confirmations) && $confirmations}
 	<div class="conf" style="display:block;">
 		{foreach $confirmations as $conf}
-			{$conf}<br />
+			{$conf|escape:html:'UTF-8'}<br />
 		{/foreach}
 	</div><br />
 {/if}
@@ -78,13 +78,13 @@
 			</span>
 			<ul {if count($warnings) > 1}style="display:none;"{/if} id="seeMore">
 			{foreach $warnings as $warning}
-				<li>{$warning}</li>
+				<li>{$warning|escape:html:'UTF-8'}</li>
 			{/foreach}
 			</ul>
 		{else}
 			<ul style="margin-top: 3px">
 			{foreach $warnings as $warning}
-				<li>{$warning}</li>
+				<li>{$warning|escape:html:'UTF-8'}</li>
 			{/foreach}
 			</ul>
 		{/if}