From b8b794e9cae3efd31646a99044325e42bf06d12e Mon Sep 17 00:00:00 2001
From: rGaillard <remi.gaillard@prestashop.com>
Date: Thu, 6 Sep 2012 15:43:45 +0000
Subject: [PATCH] // Fix PSCFV-3933

git-svn-id: http://dev.prestashop.com/svn/v1/branches/1.5.x@17215 b9a71923-0436-4b27-9f14-aed3839534dd
---
 .../controllers/cart_rules/informations.tpl       |  2 +-
 .../controllers/products/helpers/form/form.tpl    |  2 +-
 .../controllers/products/informations.tpl         |  2 +-
 admin-dev/themes/default/template/layout.tpl      | 10 +++++-----
 modules/blockcategories/blockcategories.php       |  4 ++--
 modules/blockcontact/blockcontact.tpl             |  4 ++--
 modules/blockcontactinfos/blockcontactinfos.php   |  8 ++++----
 modules/blockcontactinfos/blockcontactinfos.tpl   |  8 ++++----
 modules/blocklink/blocklink.php                   | 15 +++++++--------
 modules/blocksocial/blocksocial.php               |  6 +++---
 modules/blocksocial/blocksocial.tpl               |  8 ++++----
 modules/blocktopmenu/blocktopmenu.php             |  2 +-
 modules/mailalerts/mailalerts.php                 |  8 ++++----
 modules/watermark/watermark.php                   |  2 +-
 14 files changed, 40 insertions(+), 41 deletions(-)

diff --git a/admin-dev/themes/default/template/controllers/cart_rules/informations.tpl b/admin-dev/themes/default/template/controllers/cart_rules/informations.tpl
index 7b71c6788..de1b93b60 100644
--- a/admin-dev/themes/default/template/controllers/cart_rules/informations.tpl
+++ b/admin-dev/themes/default/template/controllers/cart_rules/informations.tpl
@@ -6,7 +6,7 @@
 				<div class="translatable">
 				{foreach from=$languages item=language}
 					<div class="lang_{$language.id_lang|intval}" style="display:{if $language.id_lang == $id_lang_default}block{else}none{/if};float:left">
-						<input type="text" id="name_{$language.id_lang|intval}" name="name_{$language.id_lang|intval}" value="{$currentTab->getFieldValue($currentObject, 'name', $language.id_lang|intval)}" style="width:400px" />
+						<input type="text" id="name_{$language.id_lang|intval}" name="name_{$language.id_lang|intval}" value="{$currentTab->getFieldValue($currentObject, 'name', $language.id_lang|intval)|escape:html:'UTF-8'}" style="width:400px" />
 						<sup>*</sup>
 					</div>
 				{/foreach}
diff --git a/admin-dev/themes/default/template/controllers/products/helpers/form/form.tpl b/admin-dev/themes/default/template/controllers/products/helpers/form/form.tpl
index f779309f0..2ee94bee2 100644
--- a/admin-dev/themes/default/template/controllers/products/helpers/form/form.tpl
+++ b/admin-dev/themes/default/template/controllers/products/helpers/form/form.tpl
@@ -237,7 +237,7 @@
 
 	<form id="product_form" action="{$form_action}" method="post" enctype="multipart/form-data" name="product" style="display:none;">
 		<input type="hidden" name="id_product" value="{$id_product}" />
-		<input type="hidden" id="is_virtual" name="is_virtual" value="{$product->is_virtual}" />
+		<input type="hidden" id="is_virtual" name="is_virtual" value="{$product->is_virtual|escape:html:'UTF-8'}" />
 		<div class="tab-pane" id="tabPane1">
 		{if !$product->active && $product->isAssociatedToShop()}
 			<div class="warn draft" >
diff --git a/admin-dev/themes/default/template/controllers/products/informations.tpl b/admin-dev/themes/default/template/controllers/products/informations.tpl
index 4df54dfba..d95bcf299 100644
--- a/admin-dev/themes/default/template/controllers/products/informations.tpl
+++ b/admin-dev/themes/default/template/controllers/products/informations.tpl
@@ -136,7 +136,7 @@
 		<tr>
 			<td class="col-left"><label>{$bullet_common_field} {l s='UPC:'}</label></td>
 			<td style="padding-bottom:5px;">
-				<input size="55" maxlength="12" type="text" name="upc" value="{$product->upc}" style="width: 130px; margin-right: 5px;" /> <span class="small">{l s='(US, Canada)'}</span>
+				<input size="55" maxlength="12" type="text" name="upc" value="{$product->upc|escape:html:'UTF-8'}" style="width: 130px; margin-right: 5px;" /> <span class="small">{l s='(US, Canada)'}</span>
 			</td>
 		</tr>
 	</table>
diff --git a/admin-dev/themes/default/template/layout.tpl b/admin-dev/themes/default/template/layout.tpl
index d4607ae5a..aafea338d 100644
--- a/admin-dev/themes/default/template/layout.tpl
+++ b/admin-dev/themes/default/template/layout.tpl
@@ -42,7 +42,7 @@
 			<br/>
 			<ol>
 				{foreach $errors as $error}
-					<li>{$error}</li>
+					<li>{$error|escape:html:'UTF-8'}</li>
 				{/foreach}
 			</ol>
 		{/if}
@@ -52,7 +52,7 @@
 {if isset($informations) && count($informations) && $informations}
 	<div class="hint clear" style="display:block;">
 		{foreach $informations as $info}
-			{$info}<br />
+			{$info|escape:html:'UTF-8'}<br />
 		{/foreach}
 	</div><br />
 {/if}
@@ -60,7 +60,7 @@
 {if isset($confirmations) && count($confirmations) && $confirmations}
 	<div class="conf" style="display:block;">
 		{foreach $confirmations as $conf}
-			{$conf}<br />
+			{$conf|escape:html:'UTF-8'}<br />
 		{/foreach}
 	</div><br />
 {/if}
@@ -78,13 +78,13 @@
 			</span>
 			<ul {if count($warnings) > 1}style="display:none;"{/if} id="seeMore">
 			{foreach $warnings as $warning}
-				<li>{$warning}</li>
+				<li>{$warning|escape:html:'UTF-8'}</li>
 			{/foreach}
 			</ul>
 		{else}
 			<ul style="margin-top: 3px">
 			{foreach $warnings as $warning}
-				<li>{$warning}</li>
+				<li>{$warning|escape:html:'UTF-8'}</li>
 			{/foreach}
 			</ul>
 		{/if}
diff --git a/modules/blockcategories/blockcategories.php b/modules/blockcategories/blockcategories.php
index 3f1842ae1..31f4b544e 100644
--- a/modules/blockcategories/blockcategories.php
+++ b/modules/blockcategories/blockcategories.php
@@ -103,7 +103,7 @@ class BlockCategories extends Module
 				<legend><img src="'.$this->_path.'logo.gif" alt="" title="" />'.$this->l('Settings').'</legend>
 				<label>'.$this->l('Maximum depth').'</label>
 				<div class="margin-form">
-					<input type="text" name="maxDepth" value="'.Configuration::get('BLOCK_CATEG_MAX_DEPTH').'" />
+					<input type="text" name="maxDepth" value="'.(int)Configuration::get('BLOCK_CATEG_MAX_DEPTH').'" />
 					<p class="clear">'.$this->l('Set the maximum depth of sublevels displayed in this block (0 = infinite)').'</p>
 				</div>
 				<label>'.$this->l('Dynamic').'</label>
@@ -129,7 +129,7 @@ class BlockCategories extends Module
 				</div>
 				<label>'.$this->l('Footer columns number').'</label>
 				<div class="margin-form">
-					<input type="text" name="nbrColumns" value="'.Configuration::get('BLOCK_CATEG_NBR_COLUMN_FOOTER').'" />
+					<input type="text" name="nbrColumns" value="'.(int)Configuration::get('BLOCK_CATEG_NBR_COLUMN_FOOTER').'" />
 					<p class="clear">'.$this->l('Set the number of footer columns').'</p>
 				</div>
 				<center><input type="submit" name="submitBlockCategories" value="'.$this->l('Save').'" class="button" /></center>
diff --git a/modules/blockcontact/blockcontact.tpl b/modules/blockcontact/blockcontact.tpl
index b27c7c977..93003150a 100644
--- a/modules/blockcontact/blockcontact.tpl
+++ b/modules/blockcontact/blockcontact.tpl
@@ -28,7 +28,7 @@
 	<h4>{l s='Contact us' mod='blockcontact'}</h4>
 	<div class="block_content clearfix">
 			<p>{l s='Our hotline is available 24/7' mod='blockcontact'}</p>
-			{if $telnumber != ''}<p class="tel"><span class="label">{l s='Phone:' mod='blockcontact'}</span>{$telnumber}</p>{/if}
-			{if $email != ''}<a href="mailto:{$email}">{l s='Contact our hotline' mod='blockcontact'}</a>{/if}
+			{if $telnumber != ''}<p class="tel"><span class="label">{l s='Phone:' mod='blockcontact'}</span>{$telnumber|escape:'htmlall':'UTF-8'}</p>{/if}
+			{if $email != ''}<a href="mailto:{$email|escape:'htmlall':'UTF-8'}">{l s='Contact our hotline' mod='blockcontact'}</a>{/if}
 	</div>
 </div>
diff --git a/modules/blockcontactinfos/blockcontactinfos.php b/modules/blockcontactinfos/blockcontactinfos.php
index a8acacf40..e7bc3b202 100644
--- a/modules/blockcontactinfos/blockcontactinfos.php
+++ b/modules/blockcontactinfos/blockcontactinfos.php
@@ -81,13 +81,13 @@ class Blockcontactinfos extends Module
 		<form action="'.Tools::htmlentitiesutf8($_SERVER['REQUEST_URI']).'" method="post">
 			<fieldset>	
 				<p><label for="company">'.$this->l('Company name').' :</label>
-				<input type="text" id="company" name="company" value="'.Configuration::get('blockcontactinfos_company').'" /></p>
+				<input type="text" id="company" name="company" value="'.Tools::safeOutput(Configuration::get('blockcontactinfos_company')).'" /></p>
 				<p><label for="address">'.$this->l('Address').' :</label>
-				<textarea id="address" name="address" cols="60" rows="4">'.Configuration::get('blockcontactinfos_address').'</textarea></p>
+				<textarea id="address" name="address" cols="60" rows="4">'.Tools::safeOutput(Configuration::get('blockcontactinfos_address')).'</textarea></p>
 				<p><label for="phone">'.$this->l('Phone number').' :</label>
-				<input type="text" id="phone" name="phone" value="'.Configuration::get('blockcontactinfos_phone').'" /></p>
+				<input type="text" id="phone" name="phone" value="'.Tools::safeOutput(Configuration::get('blockcontactinfos_phone')).'" /></p>
 				<p><label for="email">'.$this->l('Email').' :</label>
-				<input type="text" id="email" name="email" value="'.Configuration::get('blockcontactinfos_email').'" />	</p>
+				<input type="text" id="email" name="email" value="'.Tools::safeOutput(Configuration::get('blockcontactinfos_email')).'" />	</p>
 				<div class="margin-form">
 					<input type="submit" name="submitModule" value="'.$this->l('Update settings').'" class="button" /></center>
 				</div>
diff --git a/modules/blockcontactinfos/blockcontactinfos.tpl b/modules/blockcontactinfos/blockcontactinfos.tpl
index 5d0195902..73374e5a2 100644
--- a/modules/blockcontactinfos/blockcontactinfos.tpl
+++ b/modules/blockcontactinfos/blockcontactinfos.tpl
@@ -28,10 +28,10 @@
 <div id="block_contact_infos">
 	<h4>{l s='Contact us' mod='blockcontactinfos'}</h4>
 	<ul>
-		{if $blockcontactinfos_company != ''}<li><strong>{$blockcontactinfos_company}</strong></li>{/if}
-		{if $blockcontactinfos_address != ''}<li><pre>{$blockcontactinfos_address}</pre></li>{/if}
-		{if $blockcontactinfos_phone != ''}<li>{l s='Tel:'} {$blockcontactinfos_phone}</li>{/if}
-		{if $blockcontactinfos_email != ''}<li>{l s='Email:'} {mailto address=$blockcontactinfos_email encode="hex"}</li>{/if}
+		{if $blockcontactinfos_company != ''}<li><strong>{$blockcontactinfos_company|escape:'htmlall':'UTF-8'}</strong></li>{/if}
+		{if $blockcontactinfos_address != ''}<li><pre>{$blockcontactinfos_address|escape:'htmlall':'UTF-8'}</pre></li>{/if}
+		{if $blockcontactinfos_phone != ''}<li>{l s='Tel:'} {$blockcontactinfos_phone|escape:'htmlall':'UTF-8'}</li>{/if}
+		{if $blockcontactinfos_email != ''}<li>{l s='Email:'} {mailto address=$blockcontactinfos_email|escape:'htmlall':'UTF-8' encode="hex"}</li>{/if}
 	</ul>
 </div>
 <!-- /MODULE Block contact infos -->
diff --git a/modules/blocklink/blocklink.php b/modules/blocklink/blocklink.php
index 0bc6b8f31..cb2b32858 100644
--- a/modules/blocklink/blocklink.php
+++ b/modules/blocklink/blocklink.php
@@ -201,12 +201,11 @@ class BlockLink extends Module
 			$assos_shop = Tools::getValue('checkBoxShopAsso_blocklink');
 			if (empty($assos_shop))
 				return false;
-			foreach ($assos_shop as $asso)
-				foreach ($asso as $id_shop => $row)
-					Db::getInstance()->insert('blocklink_shop', array(
-						'id_blocklink' => (int)$id_link,
-						'id_shop' => (int)$id_shop,
-					));
+			foreach ($assos_shop as $id_shop => $row)
+				Db::getInstance()->insert('blocklink_shop', array(
+					'id_blocklink' => (int)$id_link,
+					'id_shop' => (int)$id_shop,
+				));
 		}
 		return true;
 	}
@@ -314,12 +313,12 @@ class BlockLink extends Module
 		}
 		$this->_html .= '
 		<script type="text/javascript">
-			id_language = Number('.$id_lang_default.');
+			id_language = Number('.(int)$id_lang_default.');
 		</script>
 		<fieldset>
 			<legend><img src="'.$this->_path.'add.png" alt="" title="" /> '.$this->l('Add a new link').'</legend>
 			<form method="post" action="index.php?controller=adminmodules&configure='.Tools::safeOutput(Tools::getValue('configure')).'&token='.Tools::safeOutput(Tools::getValue('token')).'&tab_module='.Tools::safeOutput(Tools::getValue('tab_module')).'&module_name='.Tools::safeOutput(Tools::getValue('module_name')).'">
-				<input type="hidden" name="id_link" value="'.Tools::getValue('id_link').'" />
+				<input type="hidden" name="id_link" value="'.(int)Tools::getValue('id_link').'" />
 				<label>'.$this->l('Text:').'</label>
 				<div class="margin-form">';
 			foreach ($languages as $language)
diff --git a/modules/blocksocial/blocksocial.php b/modules/blocksocial/blocksocial.php
index b751dea12..15ae763ab 100644
--- a/modules/blocksocial/blocksocial.php
+++ b/modules/blocksocial/blocksocial.php
@@ -71,13 +71,13 @@ class blocksocial extends Module
 		<form action="'.Tools::htmlentitiesutf8($_SERVER['REQUEST_URI']).'" method="post">
 			<fieldset class="width2">				
 				<label for="facebook_url">'.$this->l('Facebook URL: ').'</label>
-				<input type="text" id="facebook_url" name="facebook_url" value="'.((Configuration::get('blocksocial_facebook') != "") ? Configuration::get('blocksocial_facebook') : "").'" />
+				<input type="text" id="facebook_url" name="facebook_url" value="'.Tools::safeOutput((Configuration::get('blocksocial_facebook') != "") ? Configuration::get('blocksocial_facebook') : "").'" />
 				<div class="clear">&nbsp;</div>		
 				<label for="twitter_url">'.$this->l('Twitter URL: ').'</label>
-				<input type="text" id="twitter_url" name="twitter_url" value="'.((Configuration::get('blocksocial_twitter') != "") ? Configuration::get('blocksocial_twitter') : "").'" />
+				<input type="text" id="twitter_url" name="twitter_url" value="'.Tools::safeOutput((Configuration::get('blocksocial_twitter') != "") ? Configuration::get('blocksocial_twitter') : "").'" />
 				<div class="clear">&nbsp;</div>		
 				<label for="rss_url">'.$this->l('RSS URL: ').'</label>
-				<input type="text" id="rss_url" name="rss_url" value="'.((Configuration::get('blocksocial_rss') != "") ? Configuration::get('blocksocial_rss') : "").'" />
+				<input type="text" id="rss_url" name="rss_url" value="'.Tools::safeOutput((Configuration::get('blocksocial_rss') != "") ? Configuration::get('blocksocial_rss') : "").'" />
 				<div class="clear">&nbsp;</div>						
 				<br /><center><input type="submit" name="submitModule" value="'.$this->l('Update settings').'" class="button" /></center>
 			</fieldset>
diff --git a/modules/blocksocial/blocksocial.tpl b/modules/blocksocial/blocksocial.tpl
index b46b82b77..031064b85 100644
--- a/modules/blocksocial/blocksocial.tpl
+++ b/modules/blocksocial/blocksocial.tpl
@@ -27,8 +27,8 @@
 <div id="social_block">
 	<h4>{l s='Follow us' mod='blocksocial'}</h4>
 	<ul>
-		{if $facebook_url != ''}<li class="facebook"><a href="{$facebook_url}">{l s='Facebook' mod='blocksocial'}</a></li>{/if}
-		{if $twitter_url != ''}<li class="twitter"><a href="{$twitter_url}">{l s='Twitter' mod='blocksocial'}</a></li>{/if}
-		{if $rss_url != ''}<li class="rss"><a href="{$rss_url}">{l s='RSS' mod='blocksocial'}</a></li>{/if}
+		{if $facebook_url != ''}<li class="facebook"><a href="{$facebook_url|escape:html:'UTF-8'}">{l s='Facebook' mod='blocksocial'}</a></li>{/if}
+		{if $twitter_url != ''}<li class="twitter"><a href="{$twitter_url|escape:html:'UTF-8'}">{l s='Twitter' mod='blocksocial'}</a></li>{/if}
+		{if $rss_url != ''}<li class="rss"><a href="{$rss_url|escape:html:'UTF-8'}">{l s='RSS' mod='blocksocial'}</a></li>{/if}
 	</ul>
-</div>
\ No newline at end of file
+</div>
diff --git a/modules/blocktopmenu/blocktopmenu.php b/modules/blocktopmenu/blocktopmenu.php
index 8e1b95b9d..ab7d18ec6 100644
--- a/modules/blocktopmenu/blocktopmenu.php
+++ b/modules/blocktopmenu/blocktopmenu.php
@@ -201,7 +201,7 @@ class Blocktopmenu extends Module
 				<div style="display: none">
 				<label>'.$this->l('Items').'</label>
 				<div class="margin-form">
-					<input type="text" name="items" id="itemsInput" value="'.Configuration::get('MOD_BLOCKTOPMENU_ITEMS').'" size="70" />
+					<input type="text" name="items" id="itemsInput" value="'.Tools::safeOutput(Configuration::get('MOD_BLOCKTOPMENU_ITEMS')).'" size="70" />
 				</div>
 				</div>
 
diff --git a/modules/mailalerts/mailalerts.php b/modules/mailalerts/mailalerts.php
index a7e327f70..6a64849cb 100644
--- a/modules/mailalerts/mailalerts.php
+++ b/modules/mailalerts/mailalerts.php
@@ -159,7 +159,7 @@ class MailAlerts extends Module
 					$email = trim($email);
 					if (!empty($email) && !Validate::isEmail($email))
 					{
-						$errors[] = $this->l('Invalid e-mail:').' '.$email;
+						$errors[] = $this->l('Invalid e-mail:').' '.Tools::safeOutput($email);
 						break;
 					}
 					else if (!empty($email) && count($email) > 0)
@@ -224,7 +224,7 @@ class MailAlerts extends Module
 				</div>
 				<label>'.$this->l('Threshold:').'</label>
 				<div class="margin-form">
-					<input type="text" name="MA_LAST_QTIES" value="'.(Tools::getValue('MA_LAST_QTIES') != null ? (int)Tools::getValue('MA_LAST_QTIES') : Configuration::get('MA_LAST_QTIES')).'" size="3" />
+					<input type="text" name="MA_LAST_QTIES" value="'.(Tools::getValue('MA_LAST_QTIES') != null ? (int)Tools::getValue('MA_LAST_QTIES') : (int)Configuration::get('MA_LAST_QTIES')).'" size="3" />
 					<p>'.$this->l('Quantity for which a product is considered out of stock').'</p>
 				</div>
 				<div style="clear:both;">&nbsp;</div>
@@ -235,7 +235,7 @@ class MailAlerts extends Module
 				</div>
 				<label>'.$this->l('Coverage:').'</label>
 				<div class="margin-form">
-					<input type="text" name="MA_PRODUCT_COVERAGE" value="'.(Tools::getValue('MA_PRODUCT_COVERAGE') != null ? (int)Tools::getValue('MA_PRODUCT_COVERAGE') : Configuration::getGlobalValue('MA_PRODUCT_COVERAGE')).'" size="3" />
+					<input type="text" name="MA_PRODUCT_COVERAGE" value="'.(Tools::getValue('MA_PRODUCT_COVERAGE') != null ? (int)Tools::getValue('MA_PRODUCT_COVERAGE') : (int)Configuration::getGlobalValue('MA_PRODUCT_COVERAGE')).'" size="3" />
 					<p>'.$this->l('Stock coverage, in days. Also, the stock coverage of a given product will be calculated based on this number').'</p>
 				</div>
 				<div style="clear:both;">&nbsp;</div>
@@ -243,7 +243,7 @@ class MailAlerts extends Module
 				<label>'.$this->l('E-mail addresses:').' </label>
 				<div class="margin-form">
 					<div style="float:left; margin-right:10px;">
-						<textarea name="ma_merchant_mails" rows="10" cols="40">'.Tools::getValue('ma_merchant_mails', str_replace(self::__MA_MAIL_DELIMITOR__, "\n", $this->_merchant_mails)).'</textarea>
+						<textarea name="ma_merchant_mails" rows="10" cols="40">'.Tools::safeOutput(Tools::getValue('ma_merchant_mails', str_replace(self::__MA_MAIL_DELIMITOR__, "\n", $this->_merchant_mails))).'</textarea>
 					</div>
 					<div style="float:left;">
 						'.$this->l('One e-mail address per line (e.g. bob@example.com)').'
diff --git a/modules/watermark/watermark.php b/modules/watermark/watermark.php
index 68e6ae5f6..8284808f2 100644
--- a/modules/watermark/watermark.php
+++ b/modules/watermark/watermark.php
@@ -174,7 +174,7 @@ class Watermark extends Module
 					</tr>
 					<tr>
 						<td width="270" style="height: 35px;">'.$this->l('Watermark transparency (0-100)').'</td>
-					    <td><input type="text" name="transparency" value="'.Tools::getValue('transparency', Configuration::get('WATERMARK_TRANSPARENCY')).'" style="width: 30px;" /></td>
+					    <td><input type="text" name="transparency" value="'.(float)Tools::getValue('transparency', Configuration::get('WATERMARK_TRANSPARENCY')).'" style="width: 30px;" /></td>
 					</tr>
 					<tr><td width="270" style="height: 35px;">'.$this->l('Watermark X align').'</td>
 					    <td>