Skip to content

Commit 2c32fde

Browse files
AngelFQCAngelFQC
committed
Security: User FormValidator::addHtmlEditor FormValidator::addElement('html_editor')
1 parent 9edc811 commit 2c32fde

17 files changed

+94
-84
lines changed

‎main/exercise/MultipleAnswerTrueFalseDegreeCertainty.php

+2
Original file line numberDiff line numberDiff line change
@@ -163,6 +163,7 @@ public function createAnswersForm($form)
163163
['ToolbarSet' => 'TestProposedAnswer', 'Width' => '100%', 'Height' => '100']
164164
);
165165
$form->addRule('answer['.$i.']', get_lang('ThisFieldIsRequired'), 'required');
166+
$form->applyFilter("answer[$i]", 'attr_on_filter');
166167

167168
if (isset($_POST['answer']) && isset($_POST['answer'][$i])) {
168169
$txtAnswer->setValue(Security::remove_XSS($_POST['answer'][$i]));
@@ -177,6 +178,7 @@ public function createAnswersForm($form)
177178
['style' => 'vertical-align:middle;'],
178179
['ToolbarSet' => 'TestProposedAnswer', 'Width' => '100%', 'Height' => '100']
179180
);
181+
$form->applyFilter("comment[$i]", 'attr_on_filter');
180182

181183
if (isset($_POST['comment']) && isset($_POST['comment'][$i])) {
182184
$txtComment->setValue(Security::remove_XSS($_POST['comment'][$i]));

‎main/exercise/calculated_answer.class.php

+1
Original file line numberDiff line numberDiff line change
@@ -133,6 +133,7 @@ function updateBlanks(e) {
133133

134134
$form->addRule('answer', get_lang('GiveText'), 'required');
135135
$form->addRule('answer', get_lang('DefineBlanks'), 'regex', '/\[.*\]/');
136+
$form->applyFilter('answer', 'attr_on_filter');
136137

137138
$form->addElement('label', null, get_lang('IfYouWantOnlyIntegerValuesWriteBothLimitsWithoutDecimals'));
138139
$form->addElement('html', '<div id="blanks_weighting"></div>');

‎main/exercise/exercise_show.php

+6-4
Original file line numberDiff line numberDiff line change
@@ -659,19 +659,21 @@ function getFCK(vals, marksid) {
659659
$default = [$textareaId => $comnt];
660660

661661
if ($useAdvancedEditor) {
662-
$feedback_form->addElement(
663-
'html_editor',
662+
$feedback_form->addHtmlEditor(
664663
$textareaId,
665-
null,
666-
['id' => $textareaId],
664+
'',
665+
false,
666+
false,
667667
[
668+
'id' => $textareaId,
668669
'ToolbarSet' => 'TestAnswerFeedback',
669670
'Width' => '100%',
670671
'Height' => '120',
671672
]
672673
);
673674
} else {
674675
$feedback_form->addElement('textarea', $textareaId, ['id' => $textareaId]);
676+
$feedback_form->applyFilter($textareaId, 'attr_on_filter');
675677
}
676678
$feedback_form->setDefaults($default);
677679
$feedback_form->display();

‎main/exercise/fill_blanks.class.php

+7-5
Original file line numberDiff line numberDiff line change
@@ -338,14 +338,16 @@ function trimBlanksBetweenSeparator(inTxt, inSeparatorStart, inSeparatorEnd, add
338338
null,
339339
get_lang('TypeTextBelow').', '.get_lang('And').' '.get_lang('UseTagForBlank')
340340
);
341-
$form->addElement(
342-
'html_editor',
341+
$form->addHtmlEditor(
343342
'answer',
344343
Display::return_icon('fill_field.png'),
345-
['id' => 'answer'],
346-
['ToolbarSet' => 'TestQuestionDescription']
344+
true,
345+
false,
346+
[
347+
'id' => 'answer',
348+
'ToolbarSet' => 'TestQuestionDescription',
349+
]
347350
);
348-
$form->addRule('answer', get_lang('GiveText'), 'required');
349351

350352
//added multiple answers
351353
$form->addElement('checkbox', 'multiple_answer', '', get_lang('FillInBlankSwitchable'));

‎main/exercise/global_multiple_answer.class.php

+10-11
Original file line numberDiff line numberDiff line change
@@ -119,23 +119,22 @@ public function createAnswersForm($form)
119119
$form->addElement('checkbox', 'correct['.$i.']', null, null, 'class="checkbox"');
120120
$boxes_names[] = 'correct['.$i.']';
121121

122-
$form->addElement(
123-
'html_editor',
124-
'answer['.$i.']',
125-
null,
126-
[],
122+
$form->addHtmlEditor(
123+
"answer[$i]",
124+
'',
125+
false,
126+
false,
127127
[
128128
'ToolbarSet' => 'TestProposedAnswer',
129129
'Width' => '100%',
130130
'Height' => '100',
131131
]
132132
);
133-
$form->addRule('answer['.$i.']', get_lang('ThisFieldIsRequired'), 'required');
134-
$form->addElement(
135-
'html_editor',
136-
'comment['.$i.']',
137-
null,
138-
[],
133+
$form->addHtmlEditor(
134+
"comment[$i]",
135+
'',
136+
false,
137+
false,
139138
[
140139
'ToolbarSet' => 'TestProposedAnswer',
141140
'Width' => '100%',

‎main/exercise/multiple_answer_combination.class.php

+10-11
Original file line numberDiff line numberDiff line change
@@ -121,20 +121,19 @@ public function createAnswersForm($form)
121121
);
122122
$boxes_names[] = 'correct['.$i.']';
123123

124-
$form->addElement(
125-
'html_editor',
126-
'answer['.$i.']',
127-
null,
128-
[],
124+
$form->addHtmlEditor(
125+
"answer[$i]",
126+
'',
127+
true,
128+
false,
129129
['ToolbarSet' => 'TestProposedAnswer', 'Width' => '100%', 'Height' => '100']
130130
);
131-
$form->addRule('answer['.$i.']', get_lang('ThisFieldIsRequired'), 'required');
132131

133-
$form->addElement(
134-
'html_editor',
135-
'comment['.$i.']',
136-
null,
137-
[],
132+
$form->addHtmlEditor(
133+
"comment[$i]",
134+
'',
135+
false,
136+
false,
138137
['ToolbarSet' => 'TestProposedAnswer', 'Width' => '100%', 'Height' => '100']
139138
);
140139

‎main/exercise/multiple_answer_true_false.class.php

+1
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,7 @@ public function createAnswersForm($form)
162162
'Height' => '100',
163163
]
164164
);
165+
$form->applyFilter("comment[$i]", 'attr_on_filter');
165166

166167
if (isset($_POST['comment']) && isset($_POST['comment'][$i])) {
167168
$txtComment->setValue(Security::remove_XSS($_POST['comment'][$i]));

‎main/exercise/unique_answer_no_option.class.php

+4-4
Original file line numberDiff line numberDiff line change
@@ -190,9 +190,9 @@ public function createAnswersForm($form)
190190
$answer_number->freeze();
191191

192192
$form->addElement('radio', 'correct', null, null, $i, 'class="checkbox" style="margin-left: 0em;"');
193-
$form->addElement('html_editor', 'answer['.$i.']', null, [], $editor_config);
193+
$form->addHtmlEditor("answer[$i]", '', false, false, $editor_config);
194194

195-
$form->addElement('html_editor', 'comment['.$i.']', null, [], $editor_config);
195+
$form->addHtmlEditor("comment[$i]", '', false, false, $editor_config);
196196
$form->addElement('text', 'weighting['.$i.']', null, ['style' => 'width: 60px;', 'value' => '0']);
197197
$form->addElement('html', '</tr>');
198198
$i++;
@@ -240,10 +240,10 @@ public function createAnswersForm($form)
240240

241241
$form->addElement('hidden', 'position['.$i.']', '666');
242242
$form->addElement('radio', 'correct', null, null, $i, ['class' => 'checkbox', 'disabled' => true]);
243-
$form->addElement('html_editor', 'answer['.$i.']', null, [], $editor_config);
243+
$form->addHtmlEditor("answer[$i]", '', false, false, $editor_config);
244244

245245
$form->addRule('answer['.$i.']', get_lang('ThisFieldIsRequired'), 'required');
246-
$form->addElement('html_editor', 'comment['.$i.']', null, [], $editor_config);
246+
$form->addHtmlEditor("comment[$i]", '', false, false, $editor_config);
247247
$form->addElement('text', "weighting[$i]", null)->freeze();
248248

249249
$form->addHTml('</tr>');

‎main/forum/forumfunction.inc.php

+12-13
Original file line numberDiff line numberDiff line change
@@ -202,11 +202,11 @@ function show_add_forumcategory_form($lp_id)
202202
$form->addElement('header', get_lang('AddForumCategory'));
203203
$form->addElement('text', 'forum_category_title', get_lang('Title'), ['autofocus']);
204204
$form->applyFilter('forum_category_title', 'html_filter');
205-
$form->addElement(
206-
'html_editor',
205+
$form->addHtmlEditor(
207206
'forum_category_comment',
208207
get_lang('Description'),
209-
null,
208+
false,
209+
false,
210210
['ToolbarSet' => 'Forum', 'Width' => '98%', 'Height' => '200']
211211
);
212212

@@ -283,11 +283,11 @@ function show_add_forum_form($inputvalues = [], $lp_id = 0)
283283
$form->applyFilter('forum_title', 'html_filter');
284284

285285
// The comment of the forum.
286-
$form->addElement(
287-
'html_editor',
286+
$form->addHtmlEditor(
288287
'forum_comment',
289288
get_lang('Description'),
290-
null,
289+
false,
290+
false,
291291
['ToolbarSet' => 'Forum', 'Width' => '98%', 'Height' => '200']
292292
);
293293

@@ -533,11 +533,11 @@ function show_edit_forumcategory_form($inputvalues = [])
533533
$form->addElement('text', 'forum_category_title', get_lang('Title'));
534534
$form->applyFilter('forum_category_title', 'html_filter');
535535

536-
$form->addElement(
537-
'html_editor',
536+
$form->addHtmlEditor(
538537
'forum_category_comment',
539538
get_lang('Comment'),
540-
null,
539+
false,
540+
false,
541541
['ToolbarSet' => 'Forum', 'Width' => '98%', 'Height' => '200']
542542
);
543543

@@ -4047,11 +4047,11 @@ function show_edit_post_form(
40474047

40484048
$form->addElement('text', 'post_title', get_lang('Title'));
40494049
$form->applyFilter('post_title', 'html_filter');
4050-
$form->addElement(
4051-
'html_editor',
4050+
$form->addHtmlEditor(
40524051
'post_text',
40534052
get_lang('Text'),
4054-
null,
4053+
true,
4054+
false,
40554055
api_is_allowed_to_edit(null, true) ? [
40564056
'ToolbarSet' => 'Forum',
40574057
'Width' => '100%',
@@ -4063,7 +4063,6 @@ function show_edit_post_form(
40634063
'UserStatus' => 'student',
40644064
]
40654065
);
4066-
$form->addRule('post_text', get_lang('ThisFieldIsRequired'), 'required');
40674066

40684067
$extraFields = new ExtraField('forum_post');
40694068
$extraFields->addElements($form, $current_post['post_id']);

‎main/glossary/index.php

+6-6
Original file line numberDiff line numberDiff line change
@@ -98,11 +98,11 @@ function sorter($item1, $item2)
9898
$form->addElement('text', 'name', get_lang('TermName'), ['id' => 'glossary_title']);
9999
}
100100

101-
$form->addElement(
102-
'html_editor',
101+
$form->addHtmlEditor(
103102
'description',
104103
get_lang('TermDefinition'),
105-
null,
104+
false,
105+
false,
106106
['ToolbarSet' => 'Glossary', 'Height' => '300']
107107
);
108108
$form->addButtonCreate(get_lang('TermAddButton'), 'SubmitGlossary');
@@ -162,11 +162,11 @@ function sorter($item1, $item2)
162162
$form->addElement('text', 'name', get_lang('TermName'), ['id' => 'glossary_title']);
163163
}
164164

165-
$form->addElement(
166-
'html_editor',
165+
$form->addHtmlEditor(
167166
'description',
168167
get_lang('TermDefinition'),
169-
null,
168+
false,
169+
false,
170170
['ToolbarSet' => 'Glossary', 'Height' => '300']
171171
);
172172

‎main/inc/lib/agenda.lib.php

+4-3
Original file line numberDiff line numberDiff line change
@@ -3106,12 +3106,13 @@ public function getForm($params = [])
31063106
$toolbar = 'AgendaStudent';
31073107
}
31083108

3109-
$form->addElement(
3110-
'html_editor',
3109+
$form->addHtmlEditor(
31113110
'content',
31123111
get_lang('Description'),
3113-
null,
3112+
false,
3113+
false,
31143114
[
3115+
'style' => 'vertical-align:middle;',
31153116
'ToolbarSet' => $toolbar,
31163117
'Width' => '100%',
31173118
'Height' => '200',

‎main/inc/lib/formvalidator/FormValidator.class.php

+1
Original file line numberDiff line numberDiff line change
@@ -384,6 +384,7 @@ public function addTextarea($name, $label, $attributes = [], $required = false)
384384
if ($required) {
385385
$this->addRule($name, get_lang('ThisFieldIsRequired'), 'required');
386386
}
387+
$this->applyFilter($name, 'attr_on_filter');
387388

388389
return $element;
389390
}

‎main/lp/learnpath.class.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -9054,7 +9054,7 @@ public function display_item_form(
90549054
'BaseHref' => api_get_path(WEB_COURSE_PATH).api_get_course_path().$item_path_fck,
90559055
];
90569056

9057-
$form->addElement('html_editor', 'content_lp', '', null, $editor_config);
9057+
$form->addHtmlEditor('content_lp', '', true, true, $editor_config);
90589058
$content_path = api_get_path(SYS_COURSE_PATH).api_get_course_path().$item_path_fck;
90599059
$defaults['content_lp'] = file_get_contents($content_path);
90609060
}

‎main/lp/lp_edit.php

+3-3
Original file line numberDiff line numberDiff line change
@@ -104,11 +104,11 @@ function activate_end_date() {
104104
}
105105

106106
// Author
107-
$form->addElement(
108-
'html_editor',
107+
$form->addHtmlEditor(
109108
'lp_author',
110109
get_lang('Author'),
111-
['size' => 80],
110+
false,
111+
false,
112112
['ToolbarSet' => 'LearningPathAuthor', 'Width' => '100%', 'Height' => '200px']
113113
);
114114
$form->applyFilter('lp_author', 'html_filter');

‎main/notebook/index.php

+10-8
Original file line numberDiff line numberDiff line change
@@ -91,11 +91,12 @@ function setFocus(){
9191
$form->addElement('header', '', get_lang('NoteAddNew'));
9292
$form->addElement('text', 'note_title', get_lang('NoteTitle'), ['id' => 'note_title']);
9393
$form->applyFilter('text', 'html_filter');
94-
$form->addElement(
95-
'html_editor',
94+
$form->applyFilter('text', 'attr_on_filter');
95+
$form->addHtmlEditor(
9696
'note_comment',
9797
get_lang('NoteComment'),
98-
null,
98+
false,
99+
false,
99100
api_is_allowed_to_edit() ? ['ToolbarSet' => 'Notebook', 'Width' => '100%', 'Height' => '300'] : ['ToolbarSet' => 'NotebookStudent', 'Width' => '100%', 'Height' => '300', 'UserStatus' => 'student']
100101
);
101102
$form->addButtonCreate(get_lang('AddNote'), 'SubmitNote');
@@ -158,14 +159,15 @@ function setFocus(){
158159
$form->addElement('hidden', 'notebook_id');
159160
$form->addElement('text', 'note_title', get_lang('NoteTitle'), ['size' => '100']);
160161
$form->applyFilter('text', 'html_filter');
161-
$form->addElement(
162-
'html_editor',
162+
$form->applyFilter('text', 'attr_on_filter');
163+
$form->addHtmlEditor(
163164
'note_comment',
164165
get_lang('NoteComment'),
165-
null,
166+
false,
167+
false,
166168
api_is_allowed_to_edit()
167-
? ['ToolbarSet' => 'Notebook', 'Width' => '100%', 'Height' => '300']
168-
: ['ToolbarSet' => 'NotebookStudent', 'Width' => '100%', 'Height' => '300', 'UserStatus' => 'student']
169+
? ['ToolbarSet' => 'Notebook', 'Width' => '100%', 'Height' => '300']
170+
: ['ToolbarSet' => 'NotebookStudent', 'Width' => '100%', 'Height' => '300', 'UserStatus' => 'student']
169171
);
170172
$form->addButtonUpdate(get_lang('ModifyNote'), 'SubmitNote');
171173

0 commit comments

Comments
 (0)