dinislage/PrestaShop
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[-] Core : fixed smarty escape htmlall > html

Browse Source
This commit is contained in:
Damien Metzger
2013-11-22 09:47:15 +01:00
parent 47531534fc
commit c095d8f1ca
209 changed files with 759 additions and 759 deletions
Download Patch File Download Diff File Expand all files Collapse all files
admin-dev/themes/default/template/controllers/orders/_documents.tpl
+6 -6
View File
@@ -69,13 +69,13 @@
{if get_class($document) eq 'OrderInvoice'}
{if isset($document->is_delivery)}
<a target="_blank" title="{l s='See the document'}" href="{$link->getAdminLink('AdminPdf')|escape:'htmlall':'UTF-8'}&submitAction=generateDeliverySlipPDF&id_order_invoice={$document->id}">
<a target="_blank" title="{l s='See the document'}" href="{$link->getAdminLink('AdminPdf')|escape:'html':'UTF-8'}&submitAction=generateDeliverySlipPDF&id_order_invoice={$document->id}">
{else}
<a target="_blank" title="{l s='See the document'}" href="{$link->getAdminLink('AdminPdf')|escape:'htmlall':'UTF-8'}&submitAction=generateInvoicePDF&id_order_invoice={$document->id}">
<a target="_blank" title="{l s='See the document'}" href="{$link->getAdminLink('AdminPdf')|escape:'html':'UTF-8'}&submitAction=generateInvoicePDF&id_order_invoice={$document->id}">
{/if}
{elseif get_class($document) eq 'OrderSlip'}
<a target="_blank" title="{l s='See the document'}" href="{$link->getAdminLink('AdminPdf')|escape:'htmlall':'UTF-8'}&submitAction=generateOrderSlipPDF&id_order_slip={$document->id}">
<a target="_blank" title="{l s='See the document'}" href="{$link->getAdminLink('AdminPdf')|escape:'html':'UTF-8'}&submitAction=generateOrderSlipPDF&id_order_slip={$document->id}">
{/if}
{if get_class($document) eq 'OrderInvoice'}
@@ -142,11 +142,11 @@
{if !isset($document->is_delivery)}
<tr id="invoiceNote{$document->id}" style="display:none">
<td colspan="5">
<form action="{$current_index}&viewOrder&id_order={$order->id}{if isset($smarty.get.token)}&token={$smarty.get.token|escape:'htmlall':'UTF-8'}{/if}" method="post">
<form action="{$current_index}&viewOrder&id_order={$order->id}{if isset($smarty.get.token)}&token={$smarty.get.token|escape:'html':'UTF-8'}{/if}" method="post">
<p>
<label for="editNote{$document->id}" class="t">{l s='Note'}</label>
<input type="hidden" name="id_order_invoice" value="{$document->id}" />
<textarea name="note" id="editNote{$document->id}" class="edit-note textarea-autosize">{$document->note|escape:'htmlall':'UTF-8'}</textarea>
<textarea name="note" id="editNote{$document->id}" class="edit-note textarea-autosize">{$document->note|escape:'html':'UTF-8'}</textarea>
</p>
<p>
<button type="submit" name="submitEditNote" class="btn btn-default">
@@ -168,7 +168,7 @@
<td colspan="5" class="text-center">
<i class="icon-warning-sign"></i> {l s='No documents are available'}
{if isset($invoice_management_active) && $invoice_management_active}
<a class="btn btn-link" href="{$current_index}&viewOrder&submitGenerateInvoice&id_order={$order->id}{if isset($smarty.get.token)}&token={$smarty.get.token|escape:'htmlall':'UTF-8'}{/if}">
<a class="btn btn-link" href="{$current_index}&viewOrder&submitGenerateInvoice&id_order={$order->id}{if isset($smarty.get.token)}&token={$smarty.get.token|escape:'html':'UTF-8'}{/if}">
<i class="icon-repeat"></i>
{l s='Generate invoice'}
</a>
admin-dev/themes/default/template/controllers/orders/_print_pdf_icon.tpl
+2 -2
View File
@@ -26,7 +26,7 @@
{* Generate HTML code for printing Invoice Icon with link *}
<span>
{if ($order_state->invoice || $order->invoice_number)}
<a class="btn btn-default" target="_blank" href="{$link->getAdminLink('AdminPdf')|escape:'htmlall':'UTF-8'}&submitAction=generateInvoicePDF&id_order={$order->id}">
<a class="btn btn-default" target="_blank" href="{$link->getAdminLink('AdminPdf')|escape:'html':'UTF-8'}&submitAction=generateInvoicePDF&id_order={$order->id}">
<i class="icon-file-text"></i>
</a>
{/if}
@@ -35,7 +35,7 @@
{* Generate HTML code for printing Delivery Icon with link *}
<span>
{if ($order_state->delivery || $order->delivery_number)}
<a class="btn btn-default" target="_blank" href="{$link->getAdminLink('AdminPdf')|escape:'htmlall':'UTF-8'}&submitAction=generateDeliverySlipPDF&id_order={$order->id}">
<a class="btn btn-default" target="_blank" href="{$link->getAdminLink('AdminPdf')|escape:'html':'UTF-8'}&submitAction=generateDeliverySlipPDF&id_order={$order->id}">
<i class="icon-truck"></i>
</a>
{/if}
admin-dev/themes/default/template/controllers/orders/_product_line.tpl
+1 -1
View File
@@ -64,7 +64,7 @@
</span>
{/if}
</td>
{if $display_warehouse}<td align="center">{$product.warehouse_name|escape:'htmlall':'UTF-8'}</td>{/if}
{if $display_warehouse}<td align="center">{$product.warehouse_name|escape:'html':'UTF-8'}</td>{/if}
{if ($order->hasBeenPaid())}
<td class="productQuantity">
{$product['product_quantity_refunded']}
admin-dev/themes/default/template/controllers/orders/_shipping.tpl
+1 -1
View File
@@ -62,7 +62,7 @@
<td class="right">
<span id="shipping_number_show">{if $line.url && $line.tracking_number}<a target="_blank" href="{$line.url|replace:'@':$line.tracking_number}">{$line.tracking_number}</a>{else}{$line.tracking_number}{/if}</span>
{if $line.can_edit}
<form method="post" action="{$link->getAdminLink('AdminOrders')|escape:'htmlall':'UTF-8'}&vieworder&id_order={$order->id|escape:'htmlall':'UTF-8'}">
<form method="post" action="{$link->getAdminLink('AdminOrders')|escape:'html':'UTF-8'}&vieworder&id_order={$order->id|escape:'html':'UTF-8'}">
<span class="shipping_number_edit" style="display:none;">
<input type="hidden" name="id_order_carrier" value="{$line.id_order_carrier|htmlentities}" />
<input type="text" name="tracking_number" value="{$line.tracking_number|htmlentities}" />
admin-dev/themes/default/template/controllers/orders/form.tpl
+4 -4
View File
@@ -1075,7 +1075,7 @@
</div>
<div class="col-lg-6">
<span class="form-control-static">{l s='Or'}&nbsp;</span>
<a class="fancybox btn btn-default" href="{$link->getAdminLink('AdminCustomers')|escape:'htmlall':'UTF-8'}&addcustomer&liteDisplaying=1&submitFormAjax=1#">
<a class="fancybox btn btn-default" href="{$link->getAdminLink('AdminCustomers')|escape:'html':'UTF-8'}&addcustomer&liteDisplaying=1&submitFormAjax=1#">
<i class="icon-plus-sign-alt"></i>
{l s='Add new customer'}
</a>
@@ -1144,7 +1144,7 @@
</div>
<form class="form-horizontal" action="{$link->getAdminLink('AdminOrders')|escape:'htmlall':'UTF-8'}&submitAdd{$table}=1" method="post" autocomplete="off">
<form class="form-horizontal" action="{$link->getAdminLink('AdminOrders')|escape:'html':'UTF-8'}&submitAdd{$table}=1" method="post" autocomplete="off">
<div class="panel" id="products_part" style="display:none;">
<h3>
<i class="icon-shopping-cart"></i>
@@ -1287,7 +1287,7 @@
</div>
<div class="col-lg-6">
<span class="form-control-static">{l s='Or'}&nbsp;</span>
<a class="fancybox btn btn-default" href="{$link->getAdminLink('AdminCartRules')|escape:'htmlall':'UTF-8'}&addcart_rule&liteDisplaying=1&submitFormAjax=1#">
<a class="fancybox btn btn-default" href="{$link->getAdminLink('AdminCartRules')|escape:'html':'UTF-8'}&addcart_rule&liteDisplaying=1&submitFormAjax=1#">
<i class="icon-plus-sign-alt"></i>
{l s='Add new voucher'}
</a>
@@ -1347,7 +1347,7 @@
</div>
<div class="row">
<div class="col-lg-12">
<a class="fancybox btn btn-default" id="new_address" href="{$link->getAdminLink('AdminAddresses')|escape:'htmlall':'UTF-8'}&addaddress&id_customer=42&liteDisplaying=1&submitFormAjax=1#">
<a class="fancybox btn btn-default" id="new_address" href="{$link->getAdminLink('AdminAddresses')|escape:'html':'UTF-8'}&addaddress&id_customer=42&liteDisplaying=1&submitFormAjax=1#">
<i class="icon-plus-sign-alt"></i>
{l s='Add a new address'}
</a>
admin-dev/themes/default/template/controllers/orders/helpers/view/view.tpl
+21 -21
View File
@@ -39,7 +39,7 @@
var currency_blank = "{$currency->blank}";
var priceDisplayPrecision = 2;
var use_taxes = {if $order->getTaxCalculationMethod() == $smarty.const.PS_TAX_INC}true{else}false{/if};
var token = "{$smarty.get.token|escape:'htmlall':'UTF-8'}";
var token = "{$smarty.get.token|escape:'html':'UTF-8'}";
var stock_management = {$stock_management|intval};
var txt_add_product_stock_issue = "{l s='Are you sure you want to add this quantity?' js=1}";
var txt_add_product_new_invoice = "{l s='Are you sure you want to create a new invoice?' js=1}";
@@ -71,7 +71,7 @@
<div class="col-lg-3 box-stats color2" >
<i class="icon-comments"></i>
<span class="title">{l s='Messages'}<br /><small>&nbsp;</small></span>
<span class="value"><a href="{$link->getAdminLink('AdminCustomerThreads')|escape:'htmlall':'UTF-8'}">{sizeof($customer_thread_message)}</a></span>
<span class="value"><a href="{$link->getAdminLink('AdminCustomerThreads')|escape:'html':'UTF-8'}">{sizeof($customer_thread_message)}</a></span>
</div>
<div class="col-lg-3 box-stats color1" >
<i class="icon-ok"></i>
@@ -92,12 +92,12 @@
<div class="col-lg-6">
<div class="panel">
<h3 class="text-center">
<a class="btn btn-default pull-left" href="{$link->getAdminLink('AdminOrders')|escape:'htmlall':'UTF-8'}&vieworder&id_order={$previousOrder}" {if !$previousOrder}disabled{/if}>
<a class="btn btn-default pull-left" href="{$link->getAdminLink('AdminOrders')|escape:'html':'UTF-8'}&vieworder&id_order={$previousOrder}" {if !$previousOrder}disabled{/if}>
<i class="icon-chevron-left"></i>
{l s='Prev'}
</a>
{l s='Order'} : <strong>#{$order->id} - {$order->reference}</strong>
<a class="btn btn-default pull-right" href="{$link->getAdminLink('AdminOrders')|escape:'htmlall':'UTF-8'}&vieworder&id_order={$nextOrder}" {if !$nextOrder}disabled{/if}>
<a class="btn btn-default pull-right" href="{$link->getAdminLink('AdminOrders')|escape:'html':'UTF-8'}&vieworder&id_order={$nextOrder}" {if !$nextOrder}disabled{/if}>
{l s='Next'}
<i class="icon-chevron-right"></i>
</a>
@@ -106,7 +106,7 @@
<div class="well">
<div class="row row-margin-bottom">
{if (count($invoices_collection))}
<a class="btn btn-default" href="{$link->getAdminLink('AdminPdf')|escape:'htmlall':'UTF-8'}&submitAction=generateInvoicePDF&id_order={$order->id}" target="_blank">
<a class="btn btn-default" href="{$link->getAdminLink('AdminPdf')|escape:'html':'UTF-8'}&submitAction=generateInvoicePDF&id_order={$order->id}" target="_blank">
<i class="icon-file"></i>
{l s='View invoice'}
</a>
@@ -118,7 +118,7 @@
{l s='No invoice'}
{/if}
{if (($currentState && $currentState->delivery) || $order->delivery_number)}
<a class="btn btn-default" href="{$link->getAdminLink('AdminPdf')|escape:'htmlall':'UTF-8'}&submitAction=generateDeliverySlipPDF&id_order={$order->id}" target="_blank">
<a class="btn btn-default" href="{$link->getAdminLink('AdminPdf')|escape:'html':'UTF-8'}&submitAction=generateDeliverySlipPDF&id_order={$order->id}" target="_blank">
<i class="icon-truck"></i>
{l s='View delivery slip'}
</a>
@@ -325,7 +325,7 @@
<td>
<span id="shipping_number_show">{if isset($line.url) && isset($line.tracking_number)}<a href="{$line.url|replace:'@':$line.tracking_number}">{$line.tracking_number}</a>{elseif isset($line.tracking_number)}{$line.tracking_number}{/if}</span>
{if $line.can_edit}
<form method="post" action="{$link->getAdminLink('AdminOrders')|escape:'htmlall':'UTF-8'}&vieworder&id_order={$order->id}&id_order_invoice={if $line.id_order_invoice}{$line.id_order_invoice|escape:'htmlall':'UTF-8'}{else}0{/if}&id_carrier={if $line.id_carrier}{$line.id_carrier|escape:'htmlall':'UTF-8'}{else}0{/if}">
<form method="post" action="{$link->getAdminLink('AdminOrders')|escape:'html':'UTF-8'}&vieworder&id_order={$order->id}&id_order_invoice={if $line.id_order_invoice}{$line.id_order_invoice|escape:'html':'UTF-8'}{else}0{/if}&id_carrier={if $line.id_carrier}{$line.id_carrier|escape:'html':'UTF-8'}{else}0{/if}">
<span class="shipping_number_edit" style="display:none;">
<button type="button" name="tracking_number">
{$line.tracking_number|htmlentities}
@@ -376,7 +376,7 @@
<i class="icon-user"></i>
{l s='Customer'} :
<a href="?tab=AdminCustomers&id_customer={$customer->id}&viewcustomer&token={getAdminToken tab='AdminCustomers'}">
{$gender->name|escape:'htmlall':'UTF-8'}
{$gender->name|escape:'html':'UTF-8'}
{$customer->firstname}
{$customer->lastname}
</a>
@@ -432,7 +432,7 @@
{if !$order->isVirtual()}
<!-- Shipping address -->
{if $can_edit}
<form class="form-horizontal" method="post" action="{$link->getAdminLink('AdminOrders')|escape:'htmlall':'UTF-8'}&vieworder&id_order={$order->id}">
<form class="form-horizontal" method="post" action="{$link->getAdminLink('AdminOrders')|escape:'html':'UTF-8'}&vieworder&id_order={$order->id}">
<div class="form-group">
<div class="col-lg-9">
<select name="id_address">
@@ -475,7 +475,7 @@
<div class="tab-pane" id="addressInvoice">
<!-- Invoice address -->
{if $can_edit}
<form class="form-horizontal" method="post" action="{$link->getAdminLink('AdminOrders')|escape:'htmlall':'UTF-8'}&vieworder&id_order={$order->id}">
<form class="form-horizontal" method="post" action="{$link->getAdminLink('AdminOrders')|escape:'html':'UTF-8'}&vieworder&id_order={$order->id}">
<div class="form-group">
<div class="col-lg-9">
<select name="id_address">
@@ -534,7 +534,7 @@
<select name="order_message" id="order_message" onchange="orderOverwriteMessage(this, '{l s='Do you want to overwrite your existing message?'}')">
<option value="0" selected="selected">-</option>
{foreach from=$orderMessages item=orderMessage}
<option value="{$orderMessage['message']|escape:'htmlall':'UTF-8'}">{$orderMessage['name']}</option>
<option value="{$orderMessage['message']|escape:'html':'UTF-8'}">{$orderMessage['name']}</option>
{/foreach}
</select>
</div>
@@ -566,7 +566,7 @@
<div class="form-group">
<label class="control-label col-lg-3">{l s='Message'}</label>
<div class="col-lg-9">
<textarea id="txt_msg" class="textarea-autosize" name="message">{Tools::getValue('message')|escape:'htmlall':'UTF-8'}</textarea>
<textarea id="txt_msg" class="textarea-autosize" name="message">{Tools::getValue('message')|escape:'html':'UTF-8'}</textarea>
<p id="nbchars"></p>
</div>
</div>
@@ -591,7 +591,7 @@
<i class="icon-envelope"></i>
{l s='New message'}
</button>
<a href="{$link->getAdminLink('AdminCustomerThreads')|escape:'htmlall':'UTF-8'}">
<a href="{$link->getAdminLink('AdminCustomerThreads')|escape:'html':'UTF-8'}">
<b>{l s='Click here'}</b> {l s='to see all messages.'}
<i class="icon-external-link"></i>
</a>
@@ -624,14 +624,14 @@
<br />{l s='This warning also concerns the next orders:'}
{/if}
{/if}
<a href="{$current_index}&vieworder&id_order={$brother_order->id}&token={$smarty.get.token|escape:'htmlall':'UTF-8'}">
<a href="{$current_index}&vieworder&id_order={$brother_order->id}&token={$smarty.get.token|escape:'html':'UTF-8'}">
#{'%06d'|sprintf:$brother_order->id}
</a>
{/foreach}
</p>
{/if}
<form id="formAddPayment" method="post" action="{$current_index}&vieworder&id_order={$order->id}&token={$smarty.get.token|escape:'htmlall':'UTF-8'}">
<form id="formAddPayment" method="post" action="{$current_index}&vieworder&id_order={$order->id}&token={$smarty.get.token|escape:'html':'UTF-8'}">
<table class="table">
<thead>
<tr>
@@ -756,7 +756,7 @@
</table>
</form>
{if (!$order->valid && sizeof($currencies) > 1)}
<form class="form-horizontal well" method="post" action="{$currentIndex}&vieworder&id_order={$order->id}&token={$smarty.get.token|escape:'htmlall':'UTF-8'}">
<form class="form-horizontal well" method="post" action="{$currentIndex}&vieworder&id_order={$order->id}&token={$smarty.get.token|escape:'html':'UTF-8'}">
<div class="row">
<label class="control-label col-lg-3">{l s='Change currency'}</label>
<div class="col-lg-6">
@@ -827,7 +827,7 @@
{foreach $order->getBrother() as $brother_order}
<tr>
<td>
<a href="{$current_index}&vieworder&id_order={$brother_order->id}&token={$smarty.get.token|escape:'htmlall':'UTF-8'}">#{'%06d'|sprintf:$brother_order->id}</a>
<a href="{$current_index}&vieworder&id_order={$brother_order->id}&token={$smarty.get.token|escape:'html':'UTF-8'}">#{'%06d'|sprintf:$brother_order->id}</a>
</td>
<td>
{$brother_order->getCurrentOrderState()->name[$current_id_lang]}
@@ -836,7 +836,7 @@
{displayPrice price=$brother_order->total_paid_tax_incl currency=$currency->id}
</td>
<td>
<a href="{$current_index}&vieworder&id_order={$brother_order->id}&token={$smarty.get.token|escape:'htmlall':'UTF-8'}">
<a href="{$current_index}&vieworder&id_order={$brother_order->id}&token={$smarty.get.token|escape:'html':'UTF-8'}">
<i class="icon-eye-open"></i>
{l s='See the order'}
</a>
@@ -988,7 +988,7 @@
</td>
{if $can_edit}
<td>
<a href="{$current_index}&submitDeleteVoucher&id_order_cart_rule={$discount['id_order_cart_rule']}&id_order={$order->id}&token={$smarty.get.token|escape:'htmlall':'UTF-8'}">
<a href="{$current_index}&submitDeleteVoucher&id_order_cart_rule={$discount['id_order_cart_rule']}&id_order={$order->id}&token={$smarty.get.token|escape:'html':'UTF-8'}">
<i class="icon-minus-sign"></i>
{l s='Delete voucher'}
</a>
@@ -1122,11 +1122,11 @@
</a>
{/if}
{l s='At'} <i>{dateFormat date=$message['date_add']}</i>
{l s='from'} <b>{if ($message['elastname']|escape:'htmlall':'UTF-8')}{$message['efirstname']|escape:'htmlall':'UTF-8'} {$message['elastname']|escape:'htmlall':'UTF-8'}{else}{$message['cfirstname']|escape:'htmlall':'UTF-8'} {$message['clastname']|escape:'htmlall':'UTF-8'}{/if}</b>
{l s='from'} <b>{if ($message['elastname']|escape:'html':'UTF-8')}{$message['efirstname']|escape:'html':'UTF-8'} {$message['elastname']|escape:'html':'UTF-8'}{else}{$message['cfirstname']|escape:'html':'UTF-8'} {$message['clastname']|escape:'html':'UTF-8'}{/if}</b>
{if ($message['private'] == 1)}
<span style="color:red; font-weight:bold;">{l s='Private'}</span>
{/if}
<p>{$message['message']|escape:'htmlall':'UTF-8'|nl2br}</p>
<p>{$message['message']|escape:'html':'UTF-8'|nl2br}</p>
</div>
{/foreach}
</div>