AC-4804: Security fixes for XSS, possible sql injection on multiple scripts within...

[acontent.git] / docs / themes / default / language / language_add_edit.tmpl.php

diff --git a/docs/themes/default/language/language_add_edit.tmpl.php b/docs/themes/default/language/language_add_edit.tmpl.php
index 2ac2d52..b66f1c0 100644 (file)
--- a/docs/themes/default/language/language_add_edit.tmpl.php
+++ b/docs/themes/default/language/language_add_edit.tmpl.php
@@ -16,7 +16,7 @@ $onload = "initial();";
 include(TR_INCLUDE_PATH.'header.inc.php');\r
 ?>\r
 \r
-<form name="input_form" method="post" action="<?php echo $_SERVER['PHP_SELF']; ?><?php if (isset($_GET["id"])) echo '?id='.$_GET["id"]; ?>" >\r
+<form name="input_form" method="post" action="<?php echo $_SERVER['PHP_SELF']; ?><?php if (isset($_GET["id"])) echo '?id='.intval($_GET["id"]); ?>" >\r
 <?php if (isset($this->row["language_code"])) {?>\r
 <input type="hidden" name="language_code" value="<?php echo $this->row["language_code"]; ?>" />\r
 <input type="hidden" name="charset" value="<?php echo $this->row["charset"]; ?>" />\r
@@ -41,7 +41,7 @@ include(TR_INCLUDE_PATH.'header.inc.php');
        foreach ($this->rows_lang as $row_lang)\r
        {\r
 ?>\r
-                               <option value="<?php echo $row_lang['code_3letters']; ?>" <?php if ((isset($_POST["lang_code"]) && $_REQUEST["lang_code"] == $row_lang['code_3letters']) || (!isset($_REQUEST["lang_code"]) && $this->row["lang_code"] == $row_lang['code_3letters'])) echo 'selected="selected"'; ?>><?php echo $row_lang["description"]. ' - '. $row_lang['code_3letters']; ?></option>\r
+                               <option value="<?php echo $row_lang['code_3letters']; ?>" <?php if ((isset($_POST["lang_code"]) && $_POST["lang_code"] == $row_lang['code_3letters']) || (!isset($_REQUEST["lang_code"]) && $this->row["lang_code"] == $row_lang['code_3letters'])) echo 'selected="selected"'; ?>><?php echo $row_lang["description"]. ' - '. $row_lang['code_3letters']; ?></option>\r
 <?php\r
        }\r
 ?>\r
@@ -54,7 +54,7 @@ include(TR_INCLUDE_PATH.'header.inc.php');
                        <th><label for="lang_code">&nbsp;&nbsp;&nbsp;<?php echo _AT('lang_code'); ?></label></th>\r
                        <td>\r
 <?php if (isset($this->row['language_code'])) echo $this->row['language_code']; else {?>\r
-                               <input id="lang_code" name="lang_code" type="text" size="2" maxlength="2" value="<?php if (isset($_POST['lang_code'])) echo $_POST['lang_code']; else echo $this->row['language_code']; ?>" />\r
+                               <input id="lang_code" name="lang_code" type="text" size="2" maxlength="2" value="<?php if (isset($_POST['lang_code'])) echo AT_print($_POST['lang_code'], 'input.text'); else echo AT_print($this->row['language_code'], 'input.text'); ?>" />\r
 <?php }?>\r
                        </td>\r
                </tr>\r
@@ -63,7 +63,7 @@ include(TR_INCLUDE_PATH.'header.inc.php');
                        <th><label for="locale">&nbsp;&nbsp;&nbsp;<?php echo _AT('locale'); ?></label></th>\r
                        <td>\r
 <?php if (isset($this->row['language_code'])) if ($this->row['locale'] == '') echo _AT('na'); else echo $this->row['locale']; else {?>\r
-                               <input id="locale" name="locale" type="text" size="2" maxlength="2" value="<?php if (isset($_POST['locale'])) echo $_POST['locale']; else echo $this->row['locale']; ?>" />\r
+                               <input id="locale" name="locale" type="text" size="2" maxlength="2" value="<?php if (isset($_POST['locale'])) echo AT_print($_POST['locale'], 'input.text'); else echo AT_print($this->row['locale'], 'input.text'); ?>" />\r
 <?php }?>\r
                        </td>\r
                </tr>\r
@@ -73,7 +73,7 @@ include(TR_INCLUDE_PATH.'header.inc.php');
                        <label for="charset"><?php echo _AT('charset'); ?></label></th>\r
                        <td>\r
 <?php if (isset($this->row['language_code'])) echo $this->row['charset']; else {?>\r
-                               <input type="text" name="charset" id="charset" value="<?php if (isset($_POST['charset'])) echo $_POST['charset']; else if (isset($this->row["charset"])) echo $this->row["charset"]; else echo DEFAULT_CHARSET; ?>" />\r
+                               <input type="text" name="charset" id="charset" value="<?php if (isset($_POST['charset'])) echo $_POST['charset']; else if (isset($this->row["charset"])) echo AT_print($this->row["charset"], 'input.text'); else echo DEFAULT_CHARSET; ?>" />\r
 <?php }?>\r
                        </td>\r
                </tr>\r
@@ -81,13 +81,13 @@ include(TR_INCLUDE_PATH.'header.inc.php');
                <tr align="left">\r
                        <th><span class="required" title="<?php echo _AT('required_field'); ?>">*</span>\r
                        <label for="native_name"><?php echo _AT('name_in_language'); ?></label></th>\r
-                       <td><input type="text" name="native_name" id="native_name" value="<?php if (isset($_POST['native_name'])) echo $_POST['native_name']; else echo $this->row["native_name"]; ?>" /></td>\r
+                       <td><input type="text" name="native_name" id="native_name" value="<?php if (isset($_POST['native_name'])) echo $_POST['native_name']; else echo AT_print($this->row["native_name"], 'input.text'); ?>" /></td>\r
                </tr>\r
 \r
                <tr align="left">\r
                        <th><span class="required" title="<?php echo _AT('required_field'); ?>">*</span>\r
                        <label for="english_name"><?php echo _AT('name_in_english'); ?></label></th>\r
-                       <td><input type="text" name="english_name" id="english_name" value="<?php if (isset($_POST['english_name'])) echo $_POST['english_name']; else echo $this->row["english_name"]; ?>" /></td>\r
+                       <td><input type="text" name="english_name" id="english_name" value="<?php if (isset($_POST['english_name'])) echo $_POST['english_name']; else echo AT_print($this->row["english_name"], 'input.text'); ?>" /></td>\r
                </tr>\r
 \r
                <tr align="left">\r