From 56710ce9b79a97df093f586c90bdaf6cce6a5808 Mon Sep 17 00:00:00 2001 From: "Laurent Destailleur (aka Eldy)" Date: Wed, 8 Jan 2025 17:41:45 +0100 Subject: [PATCH] FIX CVE-2024-55227 and CVE-2024-55228 CSRF when MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY is on (hidden option not on by default) --- .../class/accountingjournal.class.php | 4 +- .../accountancy/class/bookkeeping.class.php | 4 +- htdocs/adherents/class/adherent.class.php | 4 +- .../adherents/class/adherent_type.class.php | 2 +- htdocs/admin/user.php | 10 ++-- htdocs/asset/class/asset.class.php | 4 +- htdocs/asset/class/assetmodel.class.php | 4 +- htdocs/bom/class/bom.class.php | 4 +- htdocs/bom/class/bomline.class.php | 4 +- htdocs/bookcal/class/availabilities.class.php | 4 +- htdocs/bookcal/class/calendar.class.php | 4 +- htdocs/bookmarks/class/bookmark.class.php | 4 +- htdocs/categories/class/categorie.class.php | 4 +- htdocs/comm/action/class/actioncomm.class.php | 6 +- htdocs/comm/mailing/class/mailing.class.php | 4 +- htdocs/comm/propal/class/propal.class.php | 4 +- htdocs/commande/class/commande.class.php | 4 +- htdocs/compta/bank/class/account.class.php | 4 +- .../bank/class/paymentvarious.class.php | 4 +- .../cashcontrol/class/cashcontrol.class.php | 4 +- htdocs/compta/facture/class/facture.class.php | 4 +- .../cheque/class/remisecheque.class.php | 4 +- .../compta/paiement/class/paiement.class.php | 4 +- .../sociales/class/chargesociales.class.php | 4 +- htdocs/compta/tva/class/tva.class.php | 4 +- htdocs/contact/class/contact.class.php | 4 +- htdocs/contrat/class/contrat.class.php | 4 +- htdocs/contrat/class/contratligne.class.php | 2 +- htdocs/core/class/fiscalyear.class.php | 4 +- htdocs/core/class/timespent.class.php | 4 +- htdocs/core/lib/functions.lib.php | 57 +++++++++++++++--- htdocs/cron/class/cronjob.class.php | 4 +- htdocs/delivery/class/delivery.class.php | 2 +- htdocs/ecm/class/ecmfiles.class.php | 4 +- .../class/emailcollector.class.php | 4 +- .../class/emailcollectoraction.class.php | 4 +- .../class/emailcollectorfilter.class.php | 4 +- .../class/conferenceorbooth.class.php | 4 +- .../class/conferenceorboothattendee.class.php | 4 +- htdocs/expedition/class/expedition.class.php | 4 +- .../class/expensereport.class.php | 4 +- htdocs/fichinter/class/fichinter.class.php | 4 +- .../class/fournisseur.commande.class.php | 4 +- .../fourn/class/fournisseur.facture.class.php | 4 +- .../fourn/class/fournisseur.product.class.php | 4 +- htdocs/fourn/class/paiementfourn.class.php | 4 +- htdocs/holiday/class/holiday.class.php | 4 +- htdocs/hrm/class/establishment.class.php | 4 +- htdocs/hrm/class/evaluation.class.php | 4 +- htdocs/hrm/class/evaluationdet.class.php | 4 +- htdocs/hrm/class/job.class.php | 4 +- htdocs/hrm/class/skill.class.php | 4 +- htdocs/hrm/class/skilldet.class.php | 4 +- htdocs/hrm/class/skillrank.class.php | 4 +- .../class/intracommreport.class.php | 4 +- .../class/knowledgerecord.class.php | 4 +- htdocs/loan/class/loan.class.php | 4 +- .../template/class/myobject.class.php | 4 +- htdocs/mrp/class/mo.class.php | 4 +- .../class/opensurveysondage.class.php | 4 +- .../partnership/class/partnership.class.php | 4 +- .../class/partnership_type.class.php | 4 +- .../class/productfournisseurprice.class.php | 4 +- .../inventory/class/inventory.class.php | 4 +- htdocs/product/stock/class/entrepot.class.php | 4 +- .../product/stock/class/productlot.class.php | 4 +- .../class/stocktransfer.class.php | 4 +- .../class/stocktransferline.class.php | 4 +- htdocs/projet/class/project.class.php | 4 +- htdocs/projet/class/task.class.php | 4 +- htdocs/reception/class/reception.class.php | 4 +- .../class/recruitmentcandidature.class.php | 4 +- .../class/recruitmentjobposition.class.php | 4 +- htdocs/resource/class/dolresource.class.php | 4 +- htdocs/salaries/class/paymentsalary.class.php | 4 +- htdocs/salaries/class/salary.class.php | 4 +- .../class/companypaymentmode.class.php | 4 +- htdocs/societe/class/societe.class.php | 4 +- htdocs/societe/class/societeaccount.class.php | 4 +- .../class/supplier_proposal.class.php | 4 +- htdocs/ticket/class/cticketcategory.class.php | 4 +- htdocs/ticket/class/ticket.class.php | 4 +- htdocs/user/card.php | 4 +- htdocs/user/class/user.class.php | 4 +- htdocs/user/class/usergroup.class.php | 2 +- htdocs/webhook/class/target.class.php | 4 +- htdocs/website/class/websitepage.class.php | 4 +- .../workstation/class/workstation.class.php | 4 +- htdocs/zapier/class/hook.class.php | 4 +- test/phpunit/SecurityTest.php | 58 +++++++++++++++++-- test/phpunit/test.php | 46 +++++++++++++++ 91 files changed, 325 insertions(+), 188 deletions(-) create mode 100755 test/phpunit/test.php diff --git a/htdocs/accountancy/class/accountingjournal.class.php b/htdocs/accountancy/class/accountingjournal.class.php index 4135e982d140e..3cc0aa410074f 100644 --- a/htdocs/accountancy/class/accountingjournal.class.php +++ b/htdocs/accountancy/class/accountingjournal.class.php @@ -189,9 +189,9 @@ public function getNomUrl($withpicto = 0, $withlabel = 0, $nourl = 0, $moretitle if (empty($notooltip)) { if (getDolGlobalString('MAIN_OPTIMIZEFORTEXTBROWSER')) { $label = $langs->trans("ShowAccountingJournal"); - $linkclose .= ' alt="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' alt="'.dolPrintHtmlForAttribute($label).'"'; } - $linkclose .= ' title="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' title="'.dolPrintHtmlForAttribute($label).'"'; $linkclose .= ' class="classfortooltip"'; } diff --git a/htdocs/accountancy/class/bookkeeping.class.php b/htdocs/accountancy/class/bookkeeping.class.php index f8573c3f75e71..f34694ef5bcdd 100644 --- a/htdocs/accountancy/class/bookkeeping.class.php +++ b/htdocs/accountancy/class/bookkeeping.class.php @@ -529,9 +529,9 @@ public function getNomUrl($withpicto = 0, $option = '', $notooltip = 0, $morecss if (empty($notooltip)) { if (getDolGlobalString('MAIN_OPTIMIZEFORTEXTBROWSER')) { $label = $langs->trans("ShowTransaction"); - $linkclose .= ' alt="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' alt="'.dolPrintHtmlForAttribute($label).'"'; } - $linkclose .= ' title="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' title="'.dolPrintHtmlForAttribute($label).'"'; $linkclose .= ' class="classfortooltip'.($morecss ? ' '.$morecss : '').'"'; } else { $linkclose = ($morecss ? ' class="'.$morecss.'"' : ''); diff --git a/htdocs/adherents/class/adherent.class.php b/htdocs/adherents/class/adherent.class.php index a401823fc3c1c..42c1f192825a0 100644 --- a/htdocs/adherents/class/adherent.class.php +++ b/htdocs/adherents/class/adherent.class.php @@ -2382,9 +2382,9 @@ public function getNomUrl($withpictoimg = 0, $maxlen = 0, $option = 'card', $mod if (getDolGlobalString('MAIN_OPTIMIZEFORTEXTBROWSER')) { $langs->load("users"); $label = $langs->trans("ShowUser"); - $linkclose .= ' alt="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' alt="'.dolPrintHtmlForAttribute($label).'"'; } - $linkclose .= ($label ? ' title="'.dol_escape_htmltag($label, 1).'"' : ' title="tocomplete"'); + $linkclose .= ($label ? ' title="'.dolPrintHtmlForAttribute($label).'"' : ' title="tocomplete"'); $linkclose .= $dataparams.' class="'.$classfortooltip.($morecss ? ' '.$morecss : '').'"'; } diff --git a/htdocs/adherents/class/adherent_type.class.php b/htdocs/adherents/class/adherent_type.class.php index 2947f20b15895..cf33af2334330 100644 --- a/htdocs/adherents/class/adherent_type.class.php +++ b/htdocs/adherents/class/adherent_type.class.php @@ -780,7 +780,7 @@ public function getNomUrl($withpicto = 0, $maxlen = 0, $notooltip = 0, $morecss } } $linkstart = ''; $linkend = ''; diff --git a/htdocs/admin/user.php b/htdocs/admin/user.php index bbc06499e6ef0..0c957617ce136 100644 --- a/htdocs/admin/user.php +++ b/htdocs/admin/user.php @@ -163,9 +163,9 @@ print ''; print ''.$langs->trans("UserMailRequired").''; -print ' '; +print ' '; -print ''; +print ''; if ($conf->use_javascript_ajax) { print ajax_constantonoff('USER_MAIL_REQUIRED'); } else { @@ -181,9 +181,9 @@ print ''; print ''.$langs->trans("UserHideInactive").''; -print ' '; +print ' '; -print ''; +print ''; if ($conf->use_javascript_ajax) { print ajax_constantonoff('USER_HIDE_INACTIVE_IN_COMBOBOX'); } else { @@ -325,7 +325,7 @@ if ($module->type == 'pdf') { print ''.img_object($langs->trans("Preview"), 'pdf').''; } else { - print img_object($langs->trans("PreviewNotAvailable"), 'generic'); + print img_object($langs->transnoentitiesnoconv("PreviewNotAvailable"), 'generic'); } print ''; diff --git a/htdocs/asset/class/asset.class.php b/htdocs/asset/class/asset.class.php index 9dc62995ffc3f..75566f379a716 100644 --- a/htdocs/asset/class/asset.class.php +++ b/htdocs/asset/class/asset.class.php @@ -1408,9 +1408,9 @@ public function getNomUrl($withpicto = 0, $option = '', $maxlen = 0, $notooltip if (empty($notooltip)) { if (getDolGlobalString('MAIN_OPTIMIZEFORTEXTBROWSER')) { $label = $langs->trans("ShowAsset"); - $linkclose .= ' alt="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' alt="'.dolPrintHtmlForAttribute($label).'"'; } - $linkclose .= ' title="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' title="'.dolPrintHtmlForAttribute($label).'"'; $linkclose .= ' class="classfortooltip'.($morecss ? ' '.$morecss : '').'"'; } else { $linkclose = ($morecss ? ' class="'.$morecss.'"' : ''); diff --git a/htdocs/asset/class/assetmodel.class.php b/htdocs/asset/class/assetmodel.class.php index 753b89a4a35ac..56852c052d626 100644 --- a/htdocs/asset/class/assetmodel.class.php +++ b/htdocs/asset/class/assetmodel.class.php @@ -619,9 +619,9 @@ public function getNomUrl($withpicto = 0, $option = '', $notooltip = 0, $morecss if (empty($notooltip)) { if (getDolGlobalString('MAIN_OPTIMIZEFORTEXTBROWSER')) { $label = $langs->trans("ShowAssetModel"); - $linkclose .= ' alt="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' alt="'.dolPrintHtmlForAttribute($label).'"'; } - $linkclose .= ' title="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' title="'.dolPrintHtmlForAttribute($label).'"'; $linkclose .= ' class="classfortooltip'.($morecss ? ' '.$morecss : '').'"'; } else { $linkclose = ($morecss ? ' class="'.$morecss.'"' : ''); diff --git a/htdocs/bom/class/bom.class.php b/htdocs/bom/class/bom.class.php index b6fa70ade310a..f204993c89236 100644 --- a/htdocs/bom/class/bom.class.php +++ b/htdocs/bom/class/bom.class.php @@ -1159,9 +1159,9 @@ public function getNomUrl($withpicto = 0, $option = '', $notooltip = 0, $morecss if (empty($notooltip)) { if (getDolGlobalString('MAIN_OPTIMIZEFORTEXTBROWSER')) { $label = $langs->trans("ShowBillOfMaterials"); - $linkclose .= ' alt="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' alt="'.dolPrintHtmlForAttribute($label).'"'; } - $linkclose .= ($label ? ' title="'.dol_escape_htmltag($label, 1).'"' : ' title="tocomplete"'); + $linkclose .= ($label ? ' title="'.dolPrintHtmlForAttribute($label).'"' : ' title="tocomplete"'); $linkclose .= $dataparams.' class="'.$classfortooltip.($morecss ? ' '.$morecss : '').'"'; } else { $linkclose = ($morecss ? ' class="'.$morecss.'"' : ''); diff --git a/htdocs/bom/class/bomline.class.php b/htdocs/bom/class/bomline.class.php index 92328b09fcdd0..5ebd98a756cb1 100644 --- a/htdocs/bom/class/bomline.class.php +++ b/htdocs/bom/class/bomline.class.php @@ -387,9 +387,9 @@ public function getNomUrl($withpicto = 0, $option = '', $notooltip = 0, $morecss if (empty($notooltip)) { if (getDolGlobalString('MAIN_OPTIMIZEFORTEXTBROWSER')) { $label = $langs->trans("ShowBillOfMaterialsLine"); - $linkclose .= ' alt="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' alt="'.dolPrintHtmlForAttribute($label).'"'; } - $linkclose .= ' title="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' title="'.dolPrintHtmlForAttribute($label).'"'; $linkclose .= ' class="classfortooltip'.($morecss ? ' '.$morecss : '').'"'; } else { $linkclose = ($morecss ? ' class="'.$morecss.'"' : ''); diff --git a/htdocs/bookcal/class/availabilities.class.php b/htdocs/bookcal/class/availabilities.class.php index 1c5b7c78424a3..d072343caae0d 100644 --- a/htdocs/bookcal/class/availabilities.class.php +++ b/htdocs/bookcal/class/availabilities.class.php @@ -756,9 +756,9 @@ public function getNomUrl($withpicto = 0, $option = '', $notooltip = 0, $morecss if (empty($notooltip)) { if (getDolGlobalString('MAIN_OPTIMIZEFORTEXTBROWSER')) { $label = $langs->trans("ShowAvailabilities"); - $linkclose .= ' alt="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' alt="'.dolPrintHtmlForAttribute($label).'"'; } - $linkclose .= ' title="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' title="'.dolPrintHtmlForAttribute($label).'"'; $linkclose .= ' class="classfortooltip'.($morecss ? ' '.$morecss : '').'"'; } else { $linkclose = ($morecss ? ' class="'.$morecss.'"' : ''); diff --git a/htdocs/bookcal/class/calendar.class.php b/htdocs/bookcal/class/calendar.class.php index a1acf818ba98a..c96fbe2da3405 100644 --- a/htdocs/bookcal/class/calendar.class.php +++ b/htdocs/bookcal/class/calendar.class.php @@ -742,9 +742,9 @@ public function getNomUrl($withpicto = 0, $option = '', $notooltip = 0, $morecss if (empty($notooltip)) { if (getDolGlobalInt('MAIN_OPTIMIZEFORTEXTBROWSER')) { $label = $langs->trans("ShowCalendar"); - $linkclose .= ' alt="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' alt="'.dolPrintHtmlForAttribute($label).'"'; } - $linkclose .= ($label ? ' title="'.dol_escape_htmltag($label, 1).'"' : ' title="tocomplete"'); + $linkclose .= ($label ? ' title="'.dolPrintHtmlForAttribute($label).'"' : ' title="tocomplete"'); $linkclose .= $dataparams.' class="'.$classfortooltip.($morecss ? ' '.$morecss : '').'"'; } else { $linkclose = ($morecss ? ' class="'.$morecss.'"' : ''); diff --git a/htdocs/bookmarks/class/bookmark.class.php b/htdocs/bookmarks/class/bookmark.class.php index a386876a7d614..f58d1839389b5 100644 --- a/htdocs/bookmarks/class/bookmark.class.php +++ b/htdocs/bookmarks/class/bookmark.class.php @@ -319,9 +319,9 @@ public function getNomUrl($withpicto = 0, $option = '', $notooltip = 0, $morecss if (empty($notooltip)) { if (getDolGlobalString('MAIN_OPTIMIZEFORTEXTBROWSER')) { $label = $langs->trans("ShowBookmark"); - $linkclose .= ' alt="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' alt="'.dolPrintHtmlForAttribute($label).'"'; } - $linkclose .= ' title="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' title="'.dolPrintHtmlForAttribute($label).'"'; $linkclose .= ' class="classfortooltip'.($morecss ? ' '.$morecss : '').'"'; } else { $linkclose = ($morecss ? ' class="'.$morecss.'"' : ''); diff --git a/htdocs/categories/class/categorie.class.php b/htdocs/categories/class/categorie.class.php index 09e0cb52c4748..21a642afd221d 100644 --- a/htdocs/categories/class/categorie.class.php +++ b/htdocs/categories/class/categorie.class.php @@ -1811,9 +1811,9 @@ public function getNomUrl($withpicto = 0, $option = '', $maxlength = 0, $morepar if (empty($notooltip)) { if (getDolGlobalInt('MAIN_OPTIMIZEFORTEXTBROWSER')) { $label = $langs->trans("ShowMyObject"); - $linkclose .= ' alt="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' alt="'.dolPrintHtmlForAttribute($label).'"'; } - $linkclose .= ($label ? ' title="'.dol_escape_htmltag($label, 1).'"' : ' title="tocomplete"'); + $linkclose .= ($label ? ' title="'.dolPrintHtmlForAttribute($label).'"' : ' title="tocomplete"'); $linkclose .= $dataparams.' class="'.$classfortooltip.' '.$forced_color.($morecss ? ' '.$morecss : '').'"'; } else { $linkclose = ' class="'.$forced_color.($morecss ? ' '.$morecss : '').'"'; diff --git a/htdocs/comm/action/class/actioncomm.class.php b/htdocs/comm/action/class/actioncomm.class.php index 249e342d5fcda..a96ec4e0e82bd 100644 --- a/htdocs/comm/action/class/actioncomm.class.php +++ b/htdocs/comm/action/class/actioncomm.class.php @@ -1658,6 +1658,7 @@ public function getTooltipContentArray($params) $datas['note'] .= (dol_textishtml($texttoshow) ? str_replace(array("\r", "\n"), "", $texttoshow) : str_replace(array("\r", "\n"), '
', $texttoshow)); $datas['note'] .= ''; } + // show categories for this record only in ajax to not overload lists if (isModEnabled('category') && !$nofetch) { require_once DOL_DOCUMENT_ROOT . '/categories/class/categorie.class.php'; @@ -1767,6 +1768,7 @@ public function getNomUrl($withpicto = 0, $maxlength = 0, $classname = '', $opti $tooltip .= (dol_textishtml($texttoshow) ? str_replace(array("\r", "\n"), "", $texttoshow) : str_replace(array("\r", "\n"), '
', $texttoshow)); $tooltip .= ''; } + $linkclose = ''; $classfortooltip = 'classfortooltip'; $dataparams = ''; @@ -1784,9 +1786,9 @@ public function getNomUrl($withpicto = 0, $maxlength = 0, $classname = '', $opti if (empty($notooltip)) { if (getDolGlobalString('MAIN_OPTIMIZEFORTEXTBROWSER')) { $label = $langs->trans("ShowAction"); - $linkclose .= ' alt="'.dol_escape_htmltag($tooltip, 1).'"'; + $linkclose .= ' alt="'.dolPrintHTMLForAttribute($tooltip).'"'; } - $linkclose .= ($tooltip ? ' title="'.dol_escape_htmltag($tooltip, 1).'"' : ' title="tocomplete"'); + $linkclose .= ($tooltip ? ' title="'.dolPrintHTMLForAttribute($tooltip).'"' : ' title="tocomplete"'); $linkclose .= $dataparams.' class="'.$classname.' '.$classfortooltip.'"'; } else { $linkclose .= ' class="'.$classname.'"'; diff --git a/htdocs/comm/mailing/class/mailing.class.php b/htdocs/comm/mailing/class/mailing.class.php index facaec0753fdd..d86745f21e9f2 100644 --- a/htdocs/comm/mailing/class/mailing.class.php +++ b/htdocs/comm/mailing/class/mailing.class.php @@ -852,9 +852,9 @@ public function getNomUrl($withpicto = 0, $option = '', $notooltip = 0, $morecss if (empty($notooltip)) { if (getDolGlobalString('MAIN_OPTIMIZEFORTEXTBROWSER')) { $label = $langs->trans("ShowEMailing"); - $linkclose .= ' alt="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' alt="'.dolPrintHtmlForAttribute($label).'"'; } - $linkclose .= ($label ? ' title="'.dol_escape_htmltag($label, 1).'"' : ' title="tocomplete"'); + $linkclose .= ($label ? ' title="'.dolPrintHtmlForAttribute($label).'"' : ' title="tocomplete"'); $linkclose .= $dataparams.' class="'.$classfortooltip.($morecss ? ' '.$morecss : '').'"'; } else { $linkclose = ($morecss ? ' class="'.$morecss.'"' : ''); diff --git a/htdocs/comm/propal/class/propal.class.php b/htdocs/comm/propal/class/propal.class.php index 31bb5a8dd73db..077f244654049 100644 --- a/htdocs/comm/propal/class/propal.class.php +++ b/htdocs/comm/propal/class/propal.class.php @@ -3831,9 +3831,9 @@ public function getNomUrl($withpicto = 0, $option = '', $get_params = '', $notoo if (empty($notooltip) && $user->hasRight('propal', 'lire')) { if (getDolGlobalString('MAIN_OPTIMIZEFORTEXTBROWSER')) { $label = $langs->trans("Proposal"); - $linkclose .= ' alt="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' alt="'.dolPrintHtmlForAttribute($label).'"'; } - $linkclose .= ($label ? ' title="'.dol_escape_htmltag($label, 1).'"' : ' title="tocomplete"'); + $linkclose .= ($label ? ' title="'.dolPrintHtmlForAttribute($label).'"' : ' title="tocomplete"'); $linkclose .= $dataparams.' class="'.$classfortooltip.'"'; } diff --git a/htdocs/commande/class/commande.class.php b/htdocs/commande/class/commande.class.php index 069b76a9c88ad..26efa02d0d533 100644 --- a/htdocs/commande/class/commande.class.php +++ b/htdocs/commande/class/commande.class.php @@ -3898,9 +3898,9 @@ public function getNomUrl($withpicto = 0, $option = '', $max = 0, $short = 0, $n if (empty($notooltip) && $user->hasRight('commande', 'lire')) { if (getDolGlobalString('MAIN_OPTIMIZEFORTEXTBROWSER')) { $label = $langs->trans("Order"); - $linkclose .= ' alt="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' alt="'.dolPrintHtmlForAttribute($label).'"'; } - $linkclose .= ($label ? ' title="'.dol_escape_htmltag($label, 1).'"' : ' title="tocomplete"'); + $linkclose .= ($label ? ' title="'.dolPrintHtmlForAttribute($label).'"' : ' title="tocomplete"'); $linkclose .= $dataparams.' class="'.$classfortooltip.'"'; $target_value = array('_self', '_blank', '_parent', '_top'); diff --git a/htdocs/compta/bank/class/account.class.php b/htdocs/compta/bank/class/account.class.php index 73ee30a83fec0..37050661838b1 100644 --- a/htdocs/compta/bank/class/account.class.php +++ b/htdocs/compta/bank/class/account.class.php @@ -1597,9 +1597,9 @@ public function getNomUrl($withpicto = 0, $mode = '', $option = '', $save_lastse if (empty($notooltip)) { if (getDolGlobalInt('MAIN_OPTIMIZEFORTEXTBROWSER')) { $label = $langs->trans("BankAccount"); - $linkclose .= ' alt="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' alt="'.dolPrintHtmlForAttribute($label).'"'; } - $linkclose .= ($label ? ' title="'.dol_escape_htmltag($label, 1).'"' : ' title="tocomplete"'); + $linkclose .= ($label ? ' title="'.dolPrintHtmlForAttribute($label).'"' : ' title="tocomplete"'); $linkclose .= $dataparams.' class="'.$classfortooltip.($morecss ? ' '.$morecss : '').'"'; } else { $linkclose = ($morecss ? ' class="'.$morecss.'"' : ''); diff --git a/htdocs/compta/bank/class/paymentvarious.class.php b/htdocs/compta/bank/class/paymentvarious.class.php index 1fa01691f3456..b474592d93d92 100644 --- a/htdocs/compta/bank/class/paymentvarious.class.php +++ b/htdocs/compta/bank/class/paymentvarious.class.php @@ -724,9 +724,9 @@ public function getNomUrl($withpicto = 0, $option = '', $save_lastsearch_value = if (empty($notooltip)) { if (getDolGlobalString('MAIN_OPTIMIZEFORTEXTBROWSER')) { $label = $langs->trans("ShowMyObject"); - $linkclose .= ' alt="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' alt="'.dolPrintHtmlForAttribute($label).'"'; } - $linkclose .= ' title="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' title="'.dolPrintHtmlForAttribute($label).'"'; $linkclose .= ' class="classfortooltip'.($morecss ? ' '.$morecss : '').'"'; } else { $linkclose = ($morecss ? ' class="'.$morecss.'"' : ''); diff --git a/htdocs/compta/cashcontrol/class/cashcontrol.class.php b/htdocs/compta/cashcontrol/class/cashcontrol.class.php index d2bbbf5b545b6..0e71db22c62d2 100644 --- a/htdocs/compta/cashcontrol/class/cashcontrol.class.php +++ b/htdocs/compta/cashcontrol/class/cashcontrol.class.php @@ -463,9 +463,9 @@ public function getNomUrl($withpicto = 0, $option = '', $notooltip = 0, $morecss if (empty($notooltip)) { if (getDolGlobalString('MAIN_OPTIMIZEFORTEXTBROWSER')) { $label = $langs->trans("ShowMyObject"); - $linkclose .= ' alt="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' alt="'.dolPrintHtmlForAttribute($label).'"'; } - $linkclose .= ' title="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' title="'.dolPrintHtmlForAttribute($label).'"'; $linkclose .= ' class="classfortooltip'.($morecss ? ' '.$morecss : '').'"'; } else { $linkclose = ($morecss ? ' class="'.$morecss.'"' : ''); diff --git a/htdocs/compta/facture/class/facture.class.php b/htdocs/compta/facture/class/facture.class.php index a3e40af94e92b..a3e4ef47bef43 100644 --- a/htdocs/compta/facture/class/facture.class.php +++ b/htdocs/compta/facture/class/facture.class.php @@ -2109,9 +2109,9 @@ public function getNomUrl($withpicto = 0, $option = '', $max = 0, $short = 0, $m if (empty($notooltip) && $user->hasRight("facture", "read")) { if (getDolGlobalString('MAIN_OPTIMIZEFORTEXTBROWSER')) { $label = $langs->trans("Invoice"); - $linkclose .= ' alt="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' alt="'.dolPrintHtmlForAttribute($label).'"'; } - $linkclose .= ($label ? ' title="'.dol_escape_htmltag($label, 1).'"' : ' title="tocomplete"'); + $linkclose .= ($label ? ' title="'.dolPrintHtmlForAttribute($label).'"' : ' title="tocomplete"'); $linkclose .= $dataparams.' class="'.$classfortooltip.'"'; } diff --git a/htdocs/compta/paiement/cheque/class/remisecheque.class.php b/htdocs/compta/paiement/cheque/class/remisecheque.class.php index 17527a265914a..fae7d4894aaa5 100644 --- a/htdocs/compta/paiement/cheque/class/remisecheque.class.php +++ b/htdocs/compta/paiement/cheque/class/remisecheque.class.php @@ -964,9 +964,9 @@ public function getNomUrl($withpicto = 0, $option = '', $notooltip = 0, $morecss if (empty($notooltip)) { if (getDolGlobalString('MAIN_OPTIMIZEFORTEXTBROWSER')) { $label = $langs->trans("ShowCheckReceipt"); - $linkclose .= ' alt="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' alt="'.dolPrintHtmlForAttribute($label).'"'; } - $linkclose .= ' title="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' title="'.dolPrintHtmlForAttribute($label).'"'; $linkclose .= ' class="classfortooltip'.($morecss ? ' '.$morecss : '').'"'; } else { $linkclose = ($morecss ? ' class="'.$morecss.'"' : ''); diff --git a/htdocs/compta/paiement/class/paiement.class.php b/htdocs/compta/paiement/class/paiement.class.php index cbe1c9b4111a0..29b1952861906 100644 --- a/htdocs/compta/paiement/class/paiement.class.php +++ b/htdocs/compta/paiement/class/paiement.class.php @@ -1415,9 +1415,9 @@ public function getNomUrl($withpicto = 0, $option = '', $mode = 'withlistofinvoi if (empty($notooltip)) { if (getDolGlobalString('MAIN_OPTIMIZEFORTEXTBROWSER')) { $label = $langs->trans("Payment"); - $linkclose .= ' alt="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' alt="'.dolPrintHtmlForAttribute($label).'"'; } - $linkclose .= ' title="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' title="'.dolPrintHtmlForAttribute($label).'"'; $linkclose .= ' class="classfortooltip'.($morecss ? ' '.$morecss : '').'"'; } else { $linkclose = ($morecss ? ' class="'.$morecss.'"' : ''); diff --git a/htdocs/compta/sociales/class/chargesociales.class.php b/htdocs/compta/sociales/class/chargesociales.class.php index fcfffab7b7c9c..7e64a35e963bb 100644 --- a/htdocs/compta/sociales/class/chargesociales.class.php +++ b/htdocs/compta/sociales/class/chargesociales.class.php @@ -688,9 +688,9 @@ public function getNomUrl($withpicto = 0, $option = '', $notooltip = 0, $short = if (empty($notooltip) && $user->hasRight("facture", "read")) { if (getDolGlobalString('MAIN_OPTIMIZEFORTEXTBROWSER')) { $label = $langs->trans("SocialContribution"); - $linkclose .= ' alt="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' alt="'.dolPrintHtmlForAttribute($label).'"'; } - $linkclose .= ' title="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' title="'.dolPrintHtmlForAttribute($label).'"'; $linkclose .= ' class="classfortooltip"'; } diff --git a/htdocs/compta/tva/class/tva.class.php b/htdocs/compta/tva/class/tva.class.php index 9ed504b6a138d..1b68ceaf8ae2b 100644 --- a/htdocs/compta/tva/class/tva.class.php +++ b/htdocs/compta/tva/class/tva.class.php @@ -783,9 +783,9 @@ public function getNomUrl($withpicto = 0, $option = '', $notooltip = 0, $morecss if (empty($notooltip)) { if (getDolGlobalString('MAIN_OPTIMIZEFORTEXTBROWSER')) { $label = $langs->trans("ShowMyObject"); - $linkclose .= ' alt="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' alt="'.dolPrintHtmlForAttribute($label).'"'; } - $linkclose .= ' title="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' title="'.dolPrintHtmlForAttribute($label).'"'; $linkclose .= ' class="classfortooltip'.($morecss ? ' '.$morecss : '').'"'; } else { $linkclose = ($morecss ? ' class="'.$morecss.'"' : ''); diff --git a/htdocs/contact/class/contact.class.php b/htdocs/contact/class/contact.class.php index 082639332beb0..1e19a39b9f6a3 100644 --- a/htdocs/contact/class/contact.class.php +++ b/htdocs/contact/class/contact.class.php @@ -1571,9 +1571,9 @@ public function getNomUrl($withpicto = 0, $option = '', $maxlen = 0, $moreparam if (empty($notooltip)) { if (getDolGlobalString('MAIN_OPTIMIZEFORTEXTBROWSER')) { $label = $langs->trans("ShowContact"); - $linkclose .= ' alt="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' alt="'.dolPrintHtmlForAttribute($label).'"'; } - $linkclose .= ($label ? ' title="'.dol_escape_htmltag($label, 1).'"' : ' title="tocomplete"'); + $linkclose .= ($label ? ' title="'.dolPrintHtmlForAttribute($label).'"' : ' title="tocomplete"'); $linkclose .= $dataparams.' class="'.$classfortooltip.($morecss ? ' '.$morecss : '').'"'; } else { $linkclose = ($morecss ? ' class="'.$morecss.'"' : ''); diff --git a/htdocs/contrat/class/contrat.class.php b/htdocs/contrat/class/contrat.class.php index 0f83d2dc1f450..ea22c7c335b3c 100644 --- a/htdocs/contrat/class/contrat.class.php +++ b/htdocs/contrat/class/contrat.class.php @@ -2133,9 +2133,9 @@ public function getNomUrl($withpicto = 0, $maxlength = 0, $notooltip = 0, $save_ if (empty($notooltip) && $user->hasRight('contrat', 'lire')) { if (getDolGlobalString('MAIN_OPTIMIZEFORTEXTBROWSER')) { $label = $langs->trans("ShowContract"); - $linkclose .= ' alt="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' alt="'.dolPrintHtmlForAttribute($label).'"'; } - $linkclose .= ($label ? ' title="'.dol_escape_htmltag($label, 1).'"' : ' title="tocomplete"'); + $linkclose .= ($label ? ' title="'.dolPrintHtmlForAttribute($label).'"' : ' title="tocomplete"'); $linkclose .= $dataparams.' class="'.$classfortooltip.'"'; } $linkstart = ''; $linkend = ''; diff --git a/htdocs/core/class/fiscalyear.class.php b/htdocs/core/class/fiscalyear.class.php index 0edc34a55a353..49199c2239765 100644 --- a/htdocs/core/class/fiscalyear.class.php +++ b/htdocs/core/class/fiscalyear.class.php @@ -355,9 +355,9 @@ public function getNomUrl($withpicto = 0, $notooltip = 0, $save_lastsearch_value if (empty($notooltip) && $user->hasRight('accounting', 'fiscalyear', 'write')) { if (getDolGlobalString('MAIN_OPTIMIZEFORTEXTBROWSER')) { $label = $langs->trans("FiscalPeriod"); - $linkclose .= ' alt="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' alt="'.dolPrintHtmlForAttribute($label).'"'; } - $linkclose .= ' title="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' title="'.dolPrintHtmlForAttribute($label).'"'; $linkclose .= $dataparams.' class="'.$classfortooltip.'"'; } diff --git a/htdocs/core/class/timespent.class.php b/htdocs/core/class/timespent.class.php index d0736d63a9c4a..8619d3c182e1d 100644 --- a/htdocs/core/class/timespent.class.php +++ b/htdocs/core/class/timespent.class.php @@ -757,9 +757,9 @@ public function getNomUrl($withpicto = 0, $option = '', $notooltip = 0, $morecss if (empty($notooltip)) { if (getDolGlobalString('MAIN_OPTIMIZEFORTEXTBROWSER')) { $label = $langs->trans("ShowTimeSpent"); - $linkclose .= ' alt="'.dol_escape_htmltag($label, 1).'"'; + $linkclose .= ' alt="'.dolPrintHtmlForAttribute($label).'"'; } - $linkclose .= ($label ? ' title="'.dol_escape_htmltag($label, 1).'"' : ' title="tocomplete"'); + $linkclose .= ($label ? ' title="'.dolPrintHtmlForAttribute($label).'"' : ' title="tocomplete"'); $linkclose .= $dataparams.' class="'.$classfortooltip.($morecss ? ' '.$morecss : '').'"'; } else { $linkclose = ($morecss ? ' class="'.$morecss.'"' : ''); diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php index e6ad6bab5c4b9..64d1f2137fa9b 100644 --- a/htdocs/core/lib/functions.lib.php +++ b/htdocs/core/lib/functions.lib.php @@ -2010,6 +2010,7 @@ function dolPrintText($s) /** * Return a string (that can be on several lines) ready to be output on a HTML page. * To output a text inside an attribute, you can use dolPrintHTMLForAttribute() or dolPrintHTMLForTextArea() inside a textarea + * With dolPrintHTML(), only content not already in HTML is encoded with HTML. * * @param string $s String to print * @param int $allowiframe Allow iframe tags @@ -2023,6 +2024,7 @@ function dolPrintHTML($s, $allowiframe = 0) /** * Return a string ready to be output on an HTML attribute (alt, title, data-html, ...) + * With dolPrintHTMLForAttribute(), the content is HTML encode, even if it is already HTML content. * * @param string $s String to print * @return string String ready for HTML output @@ -2032,7 +2034,7 @@ function dolPrintHTMLForAttribute($s) { // The dol_htmlentitiesbr will convert simple text into html // The dol_escape_htmltag will escape html chars. - return dol_escape_htmltag(dol_string_onlythesehtmltags(dol_htmlentitiesbr($s), 1, 0, 0, 0, array('br', 'b', 'font', 'span')), 1, -1, '', 0, 1); + return dol_escape_htmltag(dol_string_onlythesehtmltags(dol_htmlentitiesbr($s), 1, 0, 0, 0, array('br', 'b', 'font', 'hr', 'span')), 1, -1, '', 0, 1); } /** @@ -2071,7 +2073,7 @@ function dolPrintPassword($s) * @param string $stringtoescape String to escape * @param int $keepb 1=Replace b tags with escaped value (except if in $noescapetags), 0=Remove them completely * @param int $keepn 1=Preserve \r\n strings, 0=Replace them with escaped value, -1=Remove them. Set to 1 when escaping for a