From: Harris Wong <hwong@ocad.ca>
Date: Fri, 3 Sep 2010 17:20:41 +0000 (-0000)
Subject: http://atutor.ca/atutor/mantis/view.php?id=4526
X-Git-Tag: v1.1~25
X-Git-Url: https://iam.tj/gitweb/gitweb.cgi?p=acontent.git;a=commitdiff_plain;h=07fbcf50ac99965b30982f327ec31434838c0e37

http://atutor.ca/atutor/mantis/view.php?id=4526
---

diff --git a/docs/themes/default/home/course/course_property.tmpl.php b/docs/themes/default/home/course/course_property.tmpl.php
index 844bd75..81cdeb1 100644
--- a/docs/themes/default/home/course/course_property.tmpl.php
+++ b/docs/themes/default/home/course/course_property.tmpl.php
@@ -54,7 +54,7 @@ require_once(TR_INCLUDE_PATH.'classes/CoursesUtility.class.php');
 		
 		<tr>
 			<td align="left"><label for="copyright"><?php echo _AT('course_copyright'); ?></label></td>
-			<td align="left"><textarea name="copyright" rows="2" cols="65" id="copyright"><?php if (isset($_POST['copyright'])) echo stripslashes(htmlspecialchars($_POST['copyright'])); else echo $this->course_row['copyright']; ?></textarea></td>
+			<td align="left"><textarea name="copyright" rows="2" cols="65" id="copyright"><?php if (isset($_POST['copyright'])) echo stripslashes(htmlspecialchars($_POST['copyright'])); else echo stripslashes(htmlspecialchars($this->course_row['copyright'])); ?></textarea></td>
 		</tr>
 
 		<tr>
diff --git a/docs/themes/default/include/footer.tmpl.php b/docs/themes/default/include/footer.tmpl.php
index c1297eb..48c71fa 100644
--- a/docs/themes/default/include/footer.tmpl.php
+++ b/docs/themes/default/include/footer.tmpl.php
@@ -59,7 +59,7 @@ if($languageManager->getNumEnabledLanguages() > 1) {
       </div>
 		<br style="clear:both;" />
       <div style="margin-left:auto; margin-right:auto; width:20em;">
-        <small><?php if (isset($this->course_copyright)) echo $this->course_copyright.'<br />'; echo _AT("copyright"); ?></small><br />
+        <small><?php if (isset($this->course_copyright)) echo htmlentities($this->course_copyright, ENT_QUOTES, 'UTF-8').'<br />'; echo _AT("copyright"); ?></small><br />
   <!-- guide -->
 
     <div>
diff --git a/docs/themes/default/include/header.tmpl.php b/docs/themes/default/include/header.tmpl.php
index 73ca5a4..ca16834 100644
--- a/docs/themes/default/include/header.tmpl.php
+++ b/docs/themes/default/include/header.tmpl.php
@@ -162,7 +162,7 @@ foreach ($this->top_level_pages as $page) {
    
       <div class="search_top">
       <form target="_top" action="<?php echo TR_BASE_HREF; ?>home/search.php" method="get">
-        <input type="text" name="search_text" id="search_text_at_header" value="<?php if (isset($_GET['search_text'])) echo $_GET['search_text']; ?>" size="25" />
+        <input type="text" name="search_text" id="search_text_at_header" value="<?php if (isset($_GET['search_text'])) echo htmlentities($_GET['search_text'], ENT_QUOTES, 'UTF-8'); ?>" size="25" />
       
 <?php if (is_array($this->categories)) { // print category dropdown list box?>
         <select name="catid">