r28214 - /trunk/news_admin/website/export.php

[stefanbecker]

Author: stefanbecker
Date: Wed Oct 28 21:40:58 2009
New Revision: 28214

URL: http://www.egroupware.org/viewvc/egroupware?rev=28214&view=rev
Log:
"added some htmlspecial charakter to rss feed"

Modified:
    trunk/news_admin/website/export.php

Modified: trunk/news_admin/website/export.php
URL: http://www.egroupware.org/viewvc/egroupware/trunk/news_admin/website/export.php?rev=28214&r1=28213&r2=28214&view=diff
==============================================================================
--- trunk/news_admin/website/export.php (original)
+++ trunk/news_admin/website/export.php Wed Oct 28 21:40:58 2009
@@ -8,11 +8,11 @@
  * @maintainer Cornelius Weiss <nelius@...>
  * @version $Id$
  */
-
-
+
+
  /**
  * Check if we allow anon access and with which creditials
- *
+ *
  * @param array &$anon_account anon account_info with keys 'login', 'passwd' and optional 'passwd_type'
  * @return boolean true if we allow anon access, false otherwise
  */
@@ -26,7 +26,7 @@
  );
  return true;
  }
-
+
  // check if we are loaded via sitemgr's news_module
  if (!(isset($GLOBALS['egw_info']) && isset($GLOBALS['egw_info']['flags']) && isset($GLOBALS['egw_info']['flags']['currentapp']) && $GLOBALS['egw_info']['flags']['currentapp'] == 'sitemgr-link')) {
  $GLOBALS['egw_info']['flags'] = array(
@@ -37,57 +37,57 @@
  );
  include('../../header.inc.php');
  }
-
+
  $news_obj =& CreateObject('news_admin.bonews');
  $export_obj =& CreateObject('news_admin.soexport');
  $cats_obj =& CreateObject('phpgwapi.categories');
  $tpl =& CreateObject('phpgwapi.Template');
-
+
  $cat_id = (int)$_GET['cat_id'];
  $limit = (isset($_GET['limit']) ? trim($_GET['limit']) : 10);
  $reqFormat = (isset($_GET['format']) ? strtolower(trim($_GET['format'])) : null);
-
+
  $filter = $cat_id > 0 ? array('cat_id' => $cat_id) : false;
  $news = $news_obj->search('',false,'news_date DESC','','',false,'AND',array(0,$limit),$filter);
 
  if (empty($news)) {
  die('
- There are no news, sorry! Either this system is missconfigured,
+ There are no news, sorry! Either this system is missconfigured,
  you are trying something nasty, or there are really no news.
-
+
  Ask the webmaster to make shure, the access permissions in the
  news_admin application are set in a way website visitors can access news.
  ');
  }
  $formats = array(
- 1 => 'rss091',
- 2 => 'rss1',
+ 1 => 'rss091',
+ 2 => 'rss1',
  3 => 'rss2'
  );
-
+
  $itemsyntaxs = array(
  0 => '?item=',
  1 => '&item=',
  2 => '?news%5Bitem%5D=',
  3 => '&news%5Bitem%5D='
  );
-
+
  $feedConf = $export_obj->readconfig($cat_id);
-
+
  $format = $reqFormat ? $reqFormat : (
  $formats[$feedConf['type']] ? $formats[$feedConf['type']] : (
  'rss2' ));
 
- $feedConf['title'] = $feedConf['title'] ? $feedConf['title'] : (
+ $feedConf['title'] = htmlspecialchars($feedConf['title'] ? $feedConf['title'] : (
  $sitemgr_info['site_name'] ? $sitemgr_info['site_name'] : (
  $GLOBALS['egw_info']['server']['site_title'] ? $GLOBALS['egw_info']['server']['site_title'] :
- lang('News')));
-
- $feedConf['link'] = $feedConf['link'] ? $feedConf['link'] :
+ lang('News'))));
+
+ $feedConf['link'] = htmlspecialchars($feedConf['link'] ? $feedConf['link'] :
  ( $GLOBALS['sitemgr_info']['site_url'] ? ( stripos($GLOBALS['sitemgr_info']['site_url'],'http') !== false ? $GLOBALS['sitemgr_info']['site_url'] : (
  ( stripos($_SERVER['SERVER_PROTOCOL'],'https') !== false ? 'https' : 'http'). '://'. $_SERVER['HTTP_HOST']. $GLOBALS['sitemgr_info']['site_url'] )) :
- '' /* add link to news_admin here... maybe we could add an item support in export.php? */ );
-
+ '' /* add link to news_admin here... maybe we could add an item support in export.php? */ ));
+
  if ( !$feedConf['description'] ) {
  if ( $cat_id > 0 ) {
  $cat = $cats_obj->return_single($cat_id);
@@ -111,28 +111,28 @@
  $tpl->set_var('encoding', $GLOBALS['egw']->translation->charset());
  $tpl->set_var($feedConf);
 
-
+
  if(is_array($news)) {
  foreach($news as $news_data) {
- $tpl->set_var('content',$news_data['news_content']);
- $tpl->set_var('subject',$news_data['news_headline']);
- $tpl->set_var('teaser',$format == 'rss2' && $news_data['news_content'] ? '<p><b>'.$news_data['news_teaser']."</b></p>\n" :
- $news_data['news_content']);
+ $tpl->set_var('content',htmlspecialchars($news_data['news_content']));
+ $tpl->set_var('subject',htmlspecialchars($news_data['news_headline']));
+ $tpl->set_var('teaser',htmlspecialchars($format == 'rss2' && $news_data['news_content'] ? '<p><b>'.$news_data['news_teaser']."</b></p>\n" :
+ $news_data['news_content']));
 
- $tpl->set_var('item_link',$news_data['link'] ? $news_data['link'] : $feedConf['link'] . $itemsyntax . $news_data['news_id']);
+ $tpl->set_var('item_link',htmlspecialchars($news_data['link'] ? $news_data['link'] : $feedConf['link'] . $itemsyntax . $news_data['news_id']));
  $tpl->set_var('pub_date', date("r",$news_data['news_date']));
  if($format == 'rss1')
  {
  $tpl->parse('seqs','seq',True);
  }
-
+
  $tpl->parse('items','item',True);
  }
  }
  else {
  $tpl->set_var('items', '');
  }
-
+
  header('Content-type: text/xml; charset='.$GLOBALS['egw']->translation->charset());
  $tpl->pparse('out','news');
 ?>


------------------------------------------------------------------------------
Come build with us! The BlackBerry(R) Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9 - 12, 2009. Register now!
http://p.sf.net/sfu/devconference
_______________________________________________
eGroupWare-cvs mailing list
eGroupWare-cvs@...
https://lists.sourceforge.net/lists/listinfo/egroupware-cvs