Alex Aragón před 6 roky
rodič
revize
7bc63a5764

+ 1 - 1
main/admin/course_list.php

@@ -196,7 +196,7 @@ function get_course_data($from, $number_of_items, $column, $direction)
             Display::return_icon('edit.png', get_lang('Edit'), [], ICON_SIZE_SMALL).'</a>&nbsp;'.
             '<a href="'.$path.'coursecopy/create_backup.php?'.api_get_cidreq_params($courseCode).'">'.
             Display::return_icon('backup.png', get_lang('CreateBackup')).'</a>&nbsp;'.
-            '<a href="'.$path.'admin/course_list.php?delete_course='.$courseCode.'"  title="'.get_lang('ConfirmYourChoice').'" class="delete-swal">'.
+            '<a href="'.$path.'admin/course_list.php?delete_course='.$courseCode.'"  title="'.addslashes(api_htmlentities(get_lang('ConfirmYourChoice'))).'" class="delete-swal">'.
             Display::return_icon('delete.png', get_lang('Delete'), [], ICON_SIZE_SMALL).'</a>';
 
         $courseItem = [

+ 1 - 1
main/admin/system_announcements.php

@@ -388,7 +388,7 @@ if ($show_announcement_list) {
         $row[] = "<a href=\"?id=".$announcement->id."&person=".SystemAnnouncementManager::VISIBLE_GUEST."&action=".($announcement->visible_guest ? 'make_invisible' : 'make_visible')."\">".Display::return_icon(($announcement->visible_guest ? 'eyes.png' : 'eyes-close.png'), get_lang('ShowOrHide'))."</a>";*/
 
         $row[] = $announcement->lang;
-        $row[] = "<a href=\"?action=edit&id=".$announcement->id."\">".Display::return_icon('edit.png', get_lang('Edit'), [], ICON_SIZE_SMALL)."</a> <a href=\"?action=delete&id=".$announcement->id."\" title=".get_lang('ConfirmYourChoice')." class='delete-swal' >".Display::return_icon('delete.png', get_lang('Delete'), [], ICON_SIZE_SMALL)."</a>";
+        $row[] = "<a href=\"?action=edit&id=".$announcement->id."\">".Display::return_icon('edit.png', get_lang('Edit'), [], ICON_SIZE_SMALL)."</a> <a href=\"?action=delete&id=".$announcement->id."\" title=".addslashes(api_htmlentities(get_lang('ConfirmYourChoice')))." class='delete-swal' >".Display::return_icon('delete.png', get_lang('Delete'), [], ICON_SIZE_SMALL)."</a>";
         $announcement_data[] = $row;
     }
     $table = new SortableTableFromArray($announcement_data);

+ 3 - 3
main/admin/user_list.php

@@ -755,7 +755,7 @@ function modify_filter($user_id, $url_params, $row)
             api_global_admin_can_edit_admin($user_id, null, true)
         ) {
             // you cannot lock yourself out otherwise you could disable all the accounts including your own => everybody is locked out and nobody can change it anymore.
-            $result .= ' <a href="user_list.php?action=delete_user&user_id='.$user_id.'&'.$url_params.'&sec_token='.Security::getTokenFromSession().'"  title="'.get_lang('ConfirmYourChoice').'" class="delete-swal">'.
+            $result .= ' <a href="user_list.php?action=delete_user&user_id='.$user_id.'&'.$url_params.'&sec_token='.Security::getTokenFromSession().'"  title="'.addslashes(api_htmlentities(get_lang('ConfirmYourChoice'))).'" class="delete-swal">'.
                 Display::return_icon(
                     'delete.png',
                     get_lang('Delete'),
@@ -779,7 +779,7 @@ function modify_filter($user_id, $url_params, $row)
             !$user_is_anonymous &&
             api_global_admin_can_edit_admin($user_id)
         ) {
-            $result .= ' <a href="user_list.php?action=anonymize&user_id='.$user_id.'&'.$url_params.'&sec_token='.Security::getTokenFromSession().'"  class="delete-swal" title="'.get_lang("ConfirmYourChoice").'" >'.
+            $result .= ' <a href="user_list.php?action=anonymize&user_id='.$user_id.'&'.$url_params.'&sec_token='.Security::getTokenFromSession().'"  class="delete-swal" title="'.addslashes(api_htmlentities(get_lang("ConfirmYourChoice"))).'" >'.
                 Display::return_icon(
                     'anonymous.png',
                     get_lang('Anonymize'),
@@ -797,7 +797,7 @@ function modify_filter($user_id, $url_params, $row)
             ) {
                 // you cannot lock yourself out otherwise you could disable all the accounts
                 // including your own => everybody is locked out and nobody can change it anymore.
-                $result .= ' <a href="user_list.php?action=delete_user&user_id='.$user_id.'&'.$url_params.'&sec_token='.Security::getTokenFromSession().'"  title="'.get_lang("ConfirmYourChoice").'" class="delete-swal">'.
+                $result .= ' <a href="user_list.php?action=delete_user&user_id='.$user_id.'&'.$url_params.'&sec_token='.Security::getTokenFromSession().'"  title="'.addslashes(api_htmlentities(get_lang("ConfirmYourChoice"))).'" class="delete-swal">'.
                     Display::return_icon(
                         'delete.png',
                         get_lang('Delete'),

+ 2 - 2
main/inc/introductionSection.inc.php

@@ -329,7 +329,7 @@ if ($intro_dispCommand) {
             $toolbar[] = $tool;
 
             $tool = [
-                'name' => get_lang('ConfirmYourChoice'),
+                'name' => addslashes(api_htmlentities(get_lang('ConfirmYourChoice'))),
                 'url' => api_get_self()."?".api_get_cidreq().$blogParam."&intro_cmdDel=1",
                 'icon' => 'fas fa-trash-alt',
                 'class' => 'delete-swal',
@@ -344,7 +344,7 @@ if ($intro_dispCommand) {
             $toolbar[] = $tool;
 
             $tool = [
-                'name' => get_lang('ConfirmYourChoice'),
+                'name' => addslashes(api_htmlentities(get_lang('ConfirmYourChoice'))),
                 'url' => api_get_self()."?".api_get_cidreq()."&intro_cmdDel=1",
                 'icon' => 'fas fa-trash-alt',
                 'class' => 'delete-swal',

+ 2 - 2
main/user/user.php

@@ -1047,7 +1047,7 @@ function modify_filter($user_id, $row, $data)
         if ($canEditUsers) {
             // unregister
             if ($user_id != $current_user_id || api_is_platform_admin()) {
-                $result .= '<a class="btn btn-sm btn-danger delete-swal" href="'.api_get_self().'?'.api_get_cidreq().'&type='.$type.'&unregister=yes&user_id='.$user_id.'" title="'.get_lang('Unreg').' " >'.
+                $result .= '<a class="btn btn-sm btn-danger delete-swal" href="'.api_get_self().'?'.api_get_cidreq().'&type='.$type.'&unregister=yes&user_id='.$user_id.'" title="'.addslashes(api_htmlentities(get_lang('Unreg'))).' " >'.
                     get_lang('Unreg').'</a>&nbsp;';
             }
         }
@@ -1055,7 +1055,7 @@ function modify_filter($user_id, $row, $data)
         // Show buttons for unsubscribe
         if ($course_info['unsubscribe'] == 1) {
             if ($user_id == $current_user_id) {
-                $result .= '<a class="btn btn-sm btn-danger delete-swal" href="'.api_get_self().'?'.api_get_cidreq().'&type='.$type.'&unregister=yes&user_id='.$user_id.'" title="'.get_lang('Unreg').' >'.
+                $result .= '<a class="btn btn-sm btn-danger delete-swal" href="'.api_get_self().'?'.api_get_cidreq().'&type='.$type.'&unregister=yes&user_id='.$user_id.'" title="'.addslashes(api_htmlentities(get_lang('Unreg'))).' >'.
                     get_lang('Unreg').'</a>&nbsp;';
             }
         }