Changeset 3219 for trunk/lib/MT/CMS

Timestamp:

12/03/08 07:58:25 (16 months ago)

Author:

fumiakiy

Message:

Merging the latest of fireball branch to trunk. svn merge -r3095:3215 http://code.sixapart.com/svn/movabletype/branches/fireball . (two conflicts resolved; MT.pm, mt.php and mt-check.cgi merged manually.)

Location:

trunk/lib/MT/CMS

Files:

• Blog.pm (modified) (1 diff)
• Dashboard.pm (modified) (2 diffs)
• Entry.pm (modified) (2 diffs)
• Search.pm (modified) (1 diff)
• Tools.pm (modified) (1 diff)
• User.pm (modified) (3 diffs)

trunk/lib/MT/CMS/Blog.pm

@@ -1008 +1008 @@
             or return $app->error($app->translate('Can\'t load entry #[_1].', $entry_id));
         $param{build_type_name} =
-          $app->translate( "[_1] '[_2]'", $entry->class_label, $entry->title );
+          $app->translate( "[_1] '[_2]'", $entry->class_label, MT::Util::encode_html($entry->title) );
         $param{is_entry} = 1;
         $param{entry_id} = $entry_id;

trunk/lib/MT/CMS/Dashboard.pm

@@ -2 +2 @@
 
 use strict;
-use MT::Util qw( epoch2ts );
+use MT::Util qw( epoch2ts encode_html );
 
 sub dashboard {
@@ -137 +137 @@
         $param->{last_post_id}      = $last_post->id;
         $param->{last_post_blog_id} = $last_post->blog_id;
-        $param->{last_post_blog_name} = $last_post->blog->name;
+        $param->{last_post_blog_name} = encode_html($last_post->blog->name);
         $param->{last_post_ts}      = $last_post->authored_on;
     }

trunk/lib/MT/CMS/Entry.pm

@@ -189 +189 @@
     my $cats = $q->param('category_ids');
     if ( defined $cats ) {
-        if ( my @cats = split /,/, $cats ) {
+        if ( my @cats = grep { $_ =~ /^\d+/ } split /,/, $cats ) {
             $cat_id = $cats[0];
             %places = map { $_ => 1 } @cats;
@@ -1930 +1930 @@
     my $script = qq!javascript:d=document;w=window;t='';if(d.selection)t=d.selection.createRange().text;else{if(d.getSelection)t=d.getSelection();else{if(w.getSelection)t=w.getSelection()}}void(w.open('$uri&title='+encodeURIComponent(d.title)+'&text='+encodeURIComponent(d.location.href)+encodeURIComponent('<br/><br/>')+encodeURIComponent(t),'_blank','scrollbars=yes,status=yes,resizable=yes,location=yes'))!;
     # Translate the phrase here to avoid ActivePerl DLL bug.
-    $app->translate('<a href="[_1]">QuickPost to [_2]</a> - Drag this link to your browser\'s toolbar then click it when you are on a site you want to blog about.', encode_html($script), $blog->name);
+    $app->translate('<a href="[_1]">QuickPost to [_2]</a> - Drag this link to your browser\'s toolbar then click it when you are on a site you want to blog about.', encode_html($script), encode_html($blog->name));
 }
 

trunk/lib/MT/CMS/Search.pm

@@ -394 +394 @@
     my %param = %$list_pref;
     my $limit = $q->param('limit') || 125;    # FIXME: mt.cfg setting?
+    $limit =~ s/\D//g;
     my $matches;
     $date_col = $api->{date_column} || 'created_on';

trunk/lib/MT/CMS/Tools.pm

@@ -622 +622 @@
     my @tsnow    = gmtime(time);
     my $metadata = {
-        backup_by => $app->user->name . '(ID: ' . $app->user->id . ')',
+        backup_by => MT::Util::encode_xml($app->user->name, 1) . '(ID: ' . $app->user->id . ')',
         backup_on => sprintf(
             "%04d-%02d-%02dT%02d:%02d:%02d",

trunk/lib/MT/CMS/User.pm

@@ -1566 +1566 @@
         return $eh->error( $app->translate("User requires username") )
           if ( !$name );
+
+        if ( $name =~ m/([<>])/) {
+            return $eh->error( $app->translate("[_1] contains an invalid character: [_2]", $app->translate("Username"), encode_html( $1 ) ) );
+        }
     }
 
@@ -1576 +1580 @@
         return $eh->error( $app->translate("User requires display name") )
           if ( !length( $nickname ) );
+
+        if ( $nickname =~ m/([<>])/) {
+            return $eh->error( $app->translate("[_1] contains an invalid character: [_2]", $app->translate("Display Name"), encode_html( $1 ) ) );
+        }
     }
 
@@ -1614 +1622 @@
           if ( !$app->param('hint') );
     }
+    my $email = $app->param('email');
     return $eh->error(
         MT->translate("Email Address is required for password recovery") )
-      unless $app->param('email');
+      unless $email;
+    if ( $email =~ m/([<>])/) {
+        return $eh->error( $app->translate("[_1] contains an invalid character: [_2]", $app->translate("Email Address"), encode_html( $1 ) ) );
+    }
+
     if ( $app->param('url') ) {
         my $url = $app->param('url');
-        return $eh->error( MT->translate("Website URL is invalid") )
-          unless is_url($url);
+        return $eh->error( MT->translate("URL is invalid.") )
+          if !is_url($url) || ($url =~ m/[<>]/);
     }
     1;