diff --git a/db/cats_schema.sql b/db/cats_schema.sql
index 5484f266f..268b9319c 100755
--- a/db/cats_schema.sql
+++ b/db/cats_schema.sql
@@ -850,7 +850,7 @@ insert into `module_schema`(`module_schema_id`,`name`,`version`) values (9,'ext
insert into `module_schema`(`module_schema_id`,`name`,`version`) values (10,'graphs',0);
insert into `module_schema`(`module_schema_id`,`name`,`version`) values (11,'home',0);
insert into `module_schema`(`module_schema_id`,`name`,`version`) values (12,'import',0);
-insert into `module_schema`(`module_schema_id`,`name`,`version`) values (13,'install',370);
+insert into `module_schema`(`module_schema_id`,`name`,`version`) values (13,'install',371);
insert into `module_schema`(`module_schema_id`,`name`,`version`) values (14,'joborders',0);
insert into `module_schema`(`module_schema_id`,`name`,`version`) values (15,'lists',0);
insert into `module_schema`(`module_schema_id`,`name`,`version`) values (16,'login',0);
diff --git a/modules/calendar/Calendar.tpl b/modules/calendar/Calendar.tpl
index e180fa3dd..191a7d377 100755
--- a/modules/calendar/Calendar.tpl
+++ b/modules/calendar/Calendar.tpl
@@ -67,7 +67,7 @@
*
@@ -217,7 +217,7 @@
*
diff --git a/modules/calendar/CalendarUI.php b/modules/calendar/CalendarUI.php
index 7436ef833..a9cf1d6e4 100755
--- a/modules/calendar/CalendarUI.php
+++ b/modules/calendar/CalendarUI.php
@@ -402,10 +402,10 @@ private function onAddEvent()
$publicEntry = $this->isChecked('publicEntry', $_POST);
$reminderEnabled = $this->isChecked('reminderToggle', $_POST);
- $description = $this->getSanitisedInput('description', $_POST);
- $title = $this->getSanitisedInput('title', $_POST);
- $reminderEmail = $this->getSanitisedInput('sendEmail', $_POST);
- $reminderTime = $this->getSanitisedInput('reminderTime', $_POST);
+ $description = $this->getTrimmedInput('description', $_POST);
+ $title = $this->getTrimmedInput('title', $_POST);
+ $reminderEmail = $this->getTrimmedInput('sendEmail', $_POST);
+ $reminderTime = $this->getTrimmedInput('reminderTime', $_POST);
// FIXME: Reminder time must be an integer!
@@ -595,9 +595,9 @@ private function onEditEvent()
$publicEntry = $this->isChecked('publicEntry', $_POST);
$reminderEnabled = $this->isChecked('reminderToggle', $_POST);
- $description = $this->getSanitisedInput('description', $_POST);
- $title = $this->getSanitisedInput('title', $_POST);
- $reminderEmail = $this->getSanitisedInput('sendEmail', $_POST);
+ $description = $this->getTrimmedInput('description', $_POST);
+ $title = $this->getTrimmedInput('title', $_POST);
+ $reminderEmail = $this->getTrimmedInput('sendEmail', $_POST);
$reminderTime = $this->getTrimmedInput('reminderTime', $_POST);
// FIXME: Reminder time must be an integer!
diff --git a/modules/candidates/CandidatesUI.php b/modules/candidates/CandidatesUI.php
index 8aaa11582..d59a034da 100755
--- a/modules/candidates/CandidatesUI.php
+++ b/modules/candidates/CandidatesUI.php
@@ -986,28 +986,28 @@ public function checkParsingFunctions()
// Retain all field data since this isn't done over AJAX (yet)
$fields = array(
- 'firstName' => $this->getSanitisedInput('firstName', $_POST),
- 'middleName' => $this->getSanitisedInput('middleName', $_POST),
- 'lastName' => $this->getSanitisedInput('lastName', $_POST),
- 'email1' => $this->getSanitisedInput('email1', $_POST),
- 'email2' => $this->getSanitisedInput('email2', $_POST),
- 'phoneHome' => $this->getSanitisedInput('phoneHome', $_POST),
- 'phoneCell' => $this->getSanitisedInput('phoneCell', $_POST),
- 'phoneWork' => $this->getSanitisedInput('phoneWork', $_POST),
- 'address' => $this->getSanitisedInput('address', $_POST),
- 'address2' => $this->getSanitisedInput('address2', $_POST),
- 'city' => $this->getSanitisedInput('city', $_POST),
- 'state' => $this->getSanitisedInput('state', $_POST),
- 'zip' => $this->getSanitisedInput('zip', $_POST),
+ 'firstName' => $this->getTrimmedInput('firstName', $_POST),
+ 'middleName' => $this->getTrimmedInput('middleName', $_POST),
+ 'lastName' => $this->getTrimmedInput('lastName', $_POST),
+ 'email1' => $this->getTrimmedInput('email1', $_POST),
+ 'email2' => $this->getTrimmedInput('email2', $_POST),
+ 'phoneHome' => $this->getTrimmedInput('phoneHome', $_POST),
+ 'phoneCell' => $this->getTrimmedInput('phoneCell', $_POST),
+ 'phoneWork' => $this->getTrimmedInput('phoneWork', $_POST),
+ 'address' => $this->getTrimmedInput('address', $_POST),
+ 'address2' => $this->getTrimmedInput('address2', $_POST),
+ 'city' => $this->getTrimmedInput('city', $_POST),
+ 'state' => $this->getTrimmedInput('state', $_POST),
+ 'zip' => $this->getTrimmedInput('zip', $_POST),
'source' => $this->getTrimmedInput('source', $_POST),
- 'keySkills' => $this->getSanitisedInput('keySkills', $_POST),
- 'currentEmployer' => $this->getSanitisedInput('currentEmployer', $_POST),
- 'currentPay' => $this->getSanitisedInput('currentPay', $_POST),
- 'desiredPay' => $this->getSanitisedInput('desiredPay', $_POST),
- 'notes' => $this->getSanitisedInput('notes', $_POST),
- 'canRelocate' => $this->getSanitisedInput('canRelocate', $_POST),
- 'webSite' => $this->getSanitisedInput('webSite', $_POST),
- 'bestTimeToCall' => $this->getSanitisedInput('bestTimeToCall', $_POST),
+ 'keySkills' => $this->getTrimmedInput('keySkills', $_POST),
+ 'currentEmployer' => $this->getTrimmedInput('currentEmployer', $_POST),
+ 'currentPay' => $this->getTrimmedInput('currentPay', $_POST),
+ 'desiredPay' => $this->getTrimmedInput('desiredPay', $_POST),
+ 'notes' => $this->getTrimmedInput('notes', $_POST),
+ 'canRelocate' => $this->getTrimmedInput('canRelocate', $_POST),
+ 'webSite' => $this->getTrimmedInput('webSite', $_POST),
+ 'bestTimeToCall' => $this->getTrimmedInput('bestTimeToCall', $_POST),
'gender' => $this->getTrimmedInput('gender', $_POST),
'race' => $this->getTrimmedInput('race', $_POST),
'veteran' => $this->getTrimmedInput('veteran', $_POST),
@@ -1287,7 +1287,7 @@ private function onEdit()
}
$formattedPhoneHome = StringUtility::extractPhoneNumber(
- $this->getSanitisedInput('phoneHome', $_POST)
+ $this->getTrimmedInput('phoneHome', $_POST)
);
if (!empty($formattedPhoneHome))
{
@@ -1295,11 +1295,11 @@ private function onEdit()
}
else
{
- $phoneHome = $this->getSanitisedInput('phoneHome', $_POST);
+ $phoneHome = $this->getTrimmedInput('phoneHome', $_POST);
}
$formattedPhoneCell = StringUtility::extractPhoneNumber(
- $this->getSanitisedInput('phoneCell', $_POST)
+ $this->getTrimmedInput('phoneCell', $_POST)
);
if (!empty($formattedPhoneCell))
{
@@ -1307,11 +1307,11 @@ private function onEdit()
}
else
{
- $phoneCell = $this->getSanitisedInput('phoneCell', $_POST);
+ $phoneCell = $this->getTrimmedInput('phoneCell', $_POST);
}
$formattedPhoneWork = StringUtility::extractPhoneNumber(
- $this->getSanitisedInput('phoneWork', $_POST)
+ $this->getTrimmedInput('phoneWork', $_POST)
);
if (!empty($formattedPhoneWork))
{
@@ -1319,7 +1319,7 @@ private function onEdit()
}
else
{
- $phoneWork = $this->getSanitisedInput('phoneWork', $_POST);
+ $phoneWork = $this->getTrimmedInput('phoneWork', $_POST);
}
$candidateID = $_POST['candidateID'];
@@ -1392,23 +1392,23 @@ private function onEdit()
}
$isActive = $this->isChecked('isActive', $_POST);
- $firstName = $this->getSanitisedInput('firstName', $_POST);
- $middleName = $this->getSanitisedInput('middleName', $_POST);
- $lastName = $this->getSanitisedInput('lastName', $_POST);
- $email1 = $this->getSanitisedInput('email1', $_POST);
- $email2 = $this->getSanitisedInput('email2', $_POST);
- $address = $this->getSanitisedInput('address', $_POST);
- $address2 = $this->getSanitisedInput('address2', $_POST);
- $city = $this->getSanitisedInput('city', $_POST);
- $state = $this->getSanitisedInput('state', $_POST);
- $zip = $this->getSanitisedInput('zip', $_POST);
- $source = $this->getSanitisedInput('source', $_POST);
- $keySkills = $this->getSanitisedInput('keySkills', $_POST);
- $currentEmployer = $this->getSanitisedInput('currentEmployer', $_POST);
- $currentPay = $this->getSanitisedInput('currentPay', $_POST);
- $desiredPay = $this->getSanitisedInput('desiredPay', $_POST);
- $notes = $this->getSanitisedInput('notes', $_POST);
- $webSite = $this->getSanitisedInput('webSite', $_POST);
+ $firstName = $this->getTrimmedInput('firstName', $_POST);
+ $middleName = $this->getTrimmedInput('middleName', $_POST);
+ $lastName = $this->getTrimmedInput('lastName', $_POST);
+ $email1 = $this->getTrimmedInput('email1', $_POST);
+ $email2 = $this->getTrimmedInput('email2', $_POST);
+ $address = $this->getTrimmedInput('address', $_POST);
+ $address2 = $this->getTrimmedInput('address2', $_POST);
+ $city = $this->getTrimmedInput('city', $_POST);
+ $state = $this->getTrimmedInput('state', $_POST);
+ $zip = $this->getTrimmedInput('zip', $_POST);
+ $source = $this->getTrimmedInput('source', $_POST);
+ $keySkills = $this->getTrimmedInput('keySkills', $_POST);
+ $currentEmployer = $this->getTrimmedInput('currentEmployer', $_POST);
+ $currentPay = $this->getTrimmedInput('currentPay', $_POST);
+ $desiredPay = $this->getTrimmedInput('desiredPay', $_POST);
+ $notes = $this->getTrimmedInput('notes', $_POST);
+ $webSite = $this->getTrimmedInput('webSite', $_POST);
$bestTimeToCall = $this->getTrimmedInput('bestTimeToCall', $_POST);
$gender = $this->getTrimmedInput('gender', $_POST);
$race = $this->getTrimmedInput('race', $_POST);
diff --git a/modules/candidates/Show.tpl b/modules/candidates/Show.tpl
index ab1a343a0..9ec74c9d5 100755
--- a/modules/candidates/Show.tpl
+++ b/modules/candidates/Show.tpl
@@ -4,9 +4,9 @@ use OpenCATS\UI\CandidateQuickActionMenu;
use OpenCATS\UI\CandidateDuplicateQuickActionMenu;
?>
isPopup): ?>
- data['firstName'].' '.$this->data['lastName'], array( 'js/activity.js', 'js/sorttable.js', 'js/match.js', 'js/lib.js', 'js/pipeline.js', 'modules/candidates/quickAction-candidates.js')); ?>
+ data['firstName'], ENT_QUOTES, HTML_ENCODING) . ' ' . htmlspecialchars($this->data['lastName'], ENT_QUOTES, HTML_ENCODING), array( 'js/activity.js', 'js/sorttable.js', 'js/match.js', 'js/lib.js', 'js/pipeline.js', 'js/attachment.js', 'modules/candidates/quickAction-candidates.js')); ?>
- data['firstName'].' '.$this->data['lastName'], array( 'js/activity.js', 'js/sorttable.js', 'js/match.js', 'js/lib.js', 'js/pipeline.js', 'modules/candidates/quickAction-candidates.js', 'modules/candidates/quickAction-duplicates.js')); ?>
+ data['firstName'], ENT_QUOTES, HTML_ENCODING) . ' ' . htmlspecialchars($this->data['lastName'], ENT_QUOTES, HTML_ENCODING), array( 'js/activity.js', 'js/sorttable.js', 'js/match.js', 'js/lib.js', 'js/pipeline.js', 'js/attachment.js', 'modules/candidates/quickAction-candidates.js', 'modules/candidates/quickAction-duplicates.js')); ?>
active); ?>
@@ -614,7 +614,7 @@ use OpenCATS\UI\CandidateDuplicateQuickActionMenu;
lists as $rowNumber => $list): ?>
|
-
+ _($list['name']); ?>
|
diff --git a/modules/careers/CareersUI.php b/modules/careers/CareersUI.php
index f592f785c..9097a93d7 100755
--- a/modules/careers/CareersUI.php
+++ b/modules/careers/CareersUI.php
@@ -1511,7 +1511,8 @@ private function onApplyToJobOrder($siteID, $candidateID = false)
return;
}
- /* funciton getSanitisedInput used to fix XSS vuln in public portal */
+ // NOTE: Careers Portal renders these values into HTML without consistent output escaping.
+ // TODO (security/xss-hardening): Escape attributes/textarea/title consistently, then switch to getTrimmedInput().
$lastName = $this->getSanitisedInput('lastName', $_POST);
$middleName = $this->getSanitisedInput('middleName', $_POST);
$firstName = $this->getSanitisedInput('firstName', $_POST);
diff --git a/modules/companies/CompaniesUI.php b/modules/companies/CompaniesUI.php
index 49f23e287..b551aa243 100755
--- a/modules/companies/CompaniesUI.php
+++ b/modules/companies/CompaniesUI.php
@@ -544,7 +544,7 @@ private function add()
private function onAdd()
{
$formattedPhone1 = StringUtility::extractPhoneNumber(
- $this->getSanitisedInput('phone1', $_POST)
+ $this->getTrimmedInput('phone1', $_POST)
);
if (!empty($formattedPhone1))
{
@@ -552,11 +552,11 @@ private function onAdd()
}
else
{
- $phone1 = $this->getSanitisedInput('phone1', $_POST);
+ $phone1 = $this->getTrimmedInput('phone1', $_POST);
}
$formattedPhone2 = StringUtility::extractPhoneNumber(
- $this->getSanitisedInput('phone2', $_POST)
+ $this->getTrimmedInput('phone2', $_POST)
);
if (!empty($formattedPhone2))
{
@@ -564,11 +564,11 @@ private function onAdd()
}
else
{
- $phone2 = $this->getSanitisedInput('phone2', $_POST);
+ $phone2 = $this->getTrimmedInput('phone2', $_POST);
}
$formattedFaxNumber = StringUtility::extractPhoneNumber(
- $this->getSanitisedInput('faxNumber', $_POST)
+ $this->getTrimmedInput('faxNumber', $_POST)
);
if (!empty($formattedFaxNumber))
{
@@ -576,10 +576,10 @@ private function onAdd()
}
else
{
- $faxNumber = $this->getSanitisedInput('faxNumber', $_POST);
+ $faxNumber = $this->getTrimmedInput('faxNumber', $_POST);
}
- $url = $this->getSanitisedInput('url', $_POST);
+ $url = $this->getTrimmedInput('url', $_POST);
if (!empty($url))
{
$formattedURL = StringUtility::extractURL($url);
@@ -593,14 +593,14 @@ private function onAdd()
/* Hot company? */
$isHot = $this->isChecked('isHot', $_POST);
- $name = $this->getSanitisedInput('name', $_POST);
- $address = $this->getSanitisedInput('address', $_POST);
- $address2 = $this->getSanitisedInput('address2', $_POST);
- $city = $this->getSanitisedInput('city', $_POST);
- $state = $this->getSanitisedInput('state', $_POST);
- $zip = $this->getSanitisedInput('zip', $_POST);
- $keyTechnologies = $this->getSanitisedInput('keyTechnologies', $_POST);
- $notes = $this->getSanitisedInput('notes', $_POST);
+ $name = $this->getTrimmedInput('name', $_POST);
+ $address = $this->getTrimmedInput('address', $_POST);
+ $address2 = $this->getTrimmedInput('address2', $_POST);
+ $city = $this->getTrimmedInput('city', $_POST);
+ $state = $this->getTrimmedInput('state', $_POST);
+ $zip = $this->getTrimmedInput('zip', $_POST);
+ $keyTechnologies = $this->getTrimmedInput('keyTechnologies', $_POST);
+ $notes = $this->getTrimmedInput('notes', $_POST);
/* Departments list editor. */
$departmentsCSV = $this->getTrimmedInput('departmentsCSV', $_POST);
@@ -753,7 +753,7 @@ private function onEdit()
}
$formattedPhone1 = StringUtility::extractPhoneNumber(
- $this->getSanitisedInput('phone1', $_POST)
+ $this->getTrimmedInput('phone1', $_POST)
);
if (!empty($formattedPhone1))
{
@@ -761,11 +761,11 @@ private function onEdit()
}
else
{
- $phone1 = $this->getSanitisedInput('phone1', $_POST);
+ $phone1 = $this->getTrimmedInput('phone1', $_POST);
}
$formattedPhone2 = StringUtility::extractPhoneNumber(
- $this->getSanitisedInput('phone2', $_POST)
+ $this->getTrimmedInput('phone2', $_POST)
);
if (!empty($formattedPhone2))
{
@@ -773,11 +773,11 @@ private function onEdit()
}
else
{
- $phone2 = $this->getSanitisedInput('phone2', $_POST);
+ $phone2 = $this->getTrimmedInput('phone2', $_POST);
}
$formattedFaxNumber = StringUtility::extractPhoneNumber(
- $this->getSanitisedInput('faxNumber', $_POST)
+ $this->getTrimmedInput('faxNumber', $_POST)
);
if (!empty($formattedFaxNumber))
{
@@ -785,10 +785,10 @@ private function onEdit()
}
else
{
- $faxNumber = $this->getSanitisedInput('faxNumber', $_POST);
+ $faxNumber = $this->getTrimmedInput('faxNumber', $_POST);
}
- $url = $this->getSanitisedInput('url', $_POST);
+ $url = $this->getTrimmedInput('url', $_POST);
if (!empty($url))
{
$formattedURL = StringUtility::extractURL($url);
@@ -865,14 +865,14 @@ private function onEdit()
$emailAddress = '';
}
- $name = $this->getSanitisedInput('name', $_POST);
- $address = $this->getSanitisedInput('address', $_POST);
- $address2 = $this->getSanitisedInput('address2', $_POST);
- $city = $this->getSanitisedInput('city', $_POST);
- $state = $this->getSanitisedInput('state', $_POST);
- $zip = $this->getSanitisedInput('zip', $_POST);
- $keyTechnologies = $this->getSanitisedInput('keyTechnologies', $_POST);
- $notes = $this->getSanitisedInput('notes', $_POST);
+ $name = $this->getTrimmedInput('name', $_POST);
+ $address = $this->getTrimmedInput('address', $_POST);
+ $address2 = $this->getTrimmedInput('address2', $_POST);
+ $city = $this->getTrimmedInput('city', $_POST);
+ $state = $this->getTrimmedInput('state', $_POST);
+ $zip = $this->getTrimmedInput('zip', $_POST);
+ $keyTechnologies = $this->getTrimmedInput('keyTechnologies', $_POST);
+ $notes = $this->getTrimmedInput('notes', $_POST);
/* Departments list editor. */
$departmentsCSV = $this->getTrimmedInput('departmentsCSV', $_POST);
diff --git a/modules/companies/Show.tpl b/modules/companies/Show.tpl
index 86ec6a545..e016fba47 100755
--- a/modules/companies/Show.tpl
+++ b/modules/companies/Show.tpl
@@ -2,7 +2,7 @@
include_once('./vendor/autoload.php');
use OpenCATS\UI\QuickActionMenu;
?>
-data['name'], array( 'js/activity.js', 'js/sorttable.js')); ?>
+data['name'], ENT_QUOTES, HTML_ENCODING), array( 'js/activity.js', 'js/sorttable.js', 'js/attachment.js')); ?>
active); ?>
diff --git a/modules/contacts/ContactsUI.php b/modules/contacts/ContactsUI.php
index 76f739e2a..9196c473c 100755
--- a/modules/contacts/ContactsUI.php
+++ b/modules/contacts/ContactsUI.php
@@ -488,7 +488,7 @@ private function onAdd()
}
$formattedPhoneWork = StringUtility::extractPhoneNumber(
- $this->getSanitisedInput('phoneWork', $_POST)
+ $this->getTrimmedInput('phoneWork', $_POST)
);
if (!empty($formattedPhoneWork))
{
@@ -496,11 +496,11 @@ private function onAdd()
}
else
{
- $phoneWork = $this->getSanitisedInput('phoneWork', $_POST);
+ $phoneWork = $this->getTrimmedInput('phoneWork', $_POST);
}
$formattedPhoneCell = StringUtility::extractPhoneNumber(
- $this->getSanitisedInput('phoneCell', $_POST)
+ $this->getTrimmedInput('phoneCell', $_POST)
);
if (!empty($formattedPhoneCell))
{
@@ -508,11 +508,11 @@ private function onAdd()
}
else
{
- $phoneCell = $this->getSanitisedInput('phoneCell', $_POST);
+ $phoneCell = $this->getTrimmedInput('phoneCell', $_POST);
}
$formattedPhoneOther = StringUtility::extractPhoneNumber(
- $this->getSanitisedInput('phoneOther', $_POST)
+ $this->getTrimmedInput('phoneOther', $_POST)
);
if (!empty($formattedPhoneOther))
{
@@ -520,24 +520,24 @@ private function onAdd()
}
else
{
- $phoneOther = $this->getSanitisedInput('phoneOther', $_POST);
+ $phoneOther = $this->getTrimmedInput('phoneOther', $_POST);
}
$companyID = $_POST['companyID'];
- $firstName = $this->getSanitisedInput('firstName', $_POST);
- $lastName = $this->getSanitisedInput('lastName', $_POST);
- $title = $this->getSanitisedInput('title', $_POST);
+ $firstName = $this->getTrimmedInput('firstName', $_POST);
+ $lastName = $this->getTrimmedInput('lastName', $_POST);
+ $title = $this->getTrimmedInput('title', $_POST);
$department = $this->getTrimmedInput('department', $_POST);
$reportsTo = $this->getTrimmedInput('reportsTo', $_POST);
- $email1 = $this->getSanitisedInput('email1', $_POST);
- $email2 = $this->getSanitisedInput('email2', $_POST);
- $address = $this->getSanitisedInput('address', $_POST);
- $address2 = $this->getSanitisedInput('address2', $_POST);
- $city = $this->getSanitisedInput('city', $_POST);
- $state = $this->getSanitisedInput('state', $_POST);
- $zip = $this->getSanitisedInput('zip', $_POST);
- $notes = $this->getSanitisedInput('notes', $_POST);
+ $email1 = $this->getTrimmedInput('email1', $_POST);
+ $email2 = $this->getTrimmedInput('email2', $_POST);
+ $address = $this->getTrimmedInput('address', $_POST);
+ $address2 = $this->getTrimmedInput('address2', $_POST);
+ $city = $this->getTrimmedInput('city', $_POST);
+ $state = $this->getTrimmedInput('state', $_POST);
+ $zip = $this->getTrimmedInput('zip', $_POST);
+ $notes = $this->getTrimmedInput('notes', $_POST);
/* Hot contact? */
$isHot = $this->isChecked('isHot', $_POST);
@@ -715,7 +715,7 @@ private function onEdit()
$owner = $_POST['owner'];
$formattedPhoneWork = StringUtility::extractPhoneNumber(
- $this->getSanitisedInput('phoneWork', $_POST)
+ $this->getTrimmedInput('phoneWork', $_POST)
);
if (!empty($formattedPhoneWork))
{
@@ -723,11 +723,11 @@ private function onEdit()
}
else
{
- $phoneWork = $this->getSanitisedInput('phoneWork', $_POST);
+ $phoneWork = $this->getTrimmedInput('phoneWork', $_POST);
}
$formattedPhoneCell = StringUtility::extractPhoneNumber(
- $this->getSanitisedInput('phoneCell', $_POST)
+ $this->getTrimmedInput('phoneCell', $_POST)
);
if (!empty($formattedPhoneCell))
{
@@ -735,11 +735,11 @@ private function onEdit()
}
else
{
- $phoneCell = $this->getSanitisedInput('phoneCell', $_POST);
+ $phoneCell = $this->getTrimmedInput('phoneCell', $_POST);
}
$formattedPhoneOther = StringUtility::extractPhoneNumber(
- $this->getSanitisedInput('phoneOther', $_POST)
+ $this->getTrimmedInput('phoneOther', $_POST)
);
if (!empty($formattedPhoneOther))
{
@@ -747,7 +747,7 @@ private function onEdit()
}
else
{
- $phoneOther = $this->getSanitisedInput('phoneOther', $_POST);
+ $phoneOther = $this->getTrimmedInput('phoneOther', $_POST);
}
$contacts = new Contacts($this->_siteID);
@@ -814,19 +814,19 @@ private function onEdit()
$emailAddress = '';
}
- $firstName = $this->getSanitisedInput('firstName', $_POST);
- $lastName = $this->getSanitisedInput('lastName', $_POST);
- $title = $this->getSanitisedInput('title', $_POST);
+ $firstName = $this->getTrimmedInput('firstName', $_POST);
+ $lastName = $this->getTrimmedInput('lastName', $_POST);
+ $title = $this->getTrimmedInput('title', $_POST);
$department = $this->getTrimmedInput('department', $_POST);
$reportsTo = $this->getTrimmedInput('reportsTo', $_POST);
- $email1 = $this->getSanitisedInput('email1', $_POST);
- $email2 = $this->getSanitisedInput('email2', $_POST);
- $address = $this->getSanitisedInput('address', $_POST);
- $address2 = $this->getSanitisedInput('address2', $_POST);
- $city = $this->getSanitisedInput('city', $_POST);
- $state = $this->getSanitisedInput('state', $_POST);
- $zip = $this->getSanitisedInput('zip', $_POST);
- $notes = $this->getSanitisedInput('notes', $_POST);
+ $email1 = $this->getTrimmedInput('email1', $_POST);
+ $email2 = $this->getTrimmedInput('email2', $_POST);
+ $address = $this->getTrimmedInput('address', $_POST);
+ $address2 = $this->getTrimmedInput('address2', $_POST);
+ $city = $this->getTrimmedInput('city', $_POST);
+ $state = $this->getTrimmedInput('state', $_POST);
+ $zip = $this->getTrimmedInput('zip', $_POST);
+ $notes = $this->getTrimmedInput('notes', $_POST);
$isHot = $this->isChecked('isHot', $_POST);
$leftCompany = $this->isChecked('leftCompany', $_POST);
@@ -1361,9 +1361,7 @@ private function _addActivityScheduleEvent($regardingID, $directoryOverride = ''
CommonErrors::fatalModal(COMMONERROR_BADINDEX, $this, 'Invalid activity type ID.');
}
- $activityNote = $this->getSanitisedInput('activityNote', $_POST);
-
- $activityNote = htmlspecialchars($activityNote);
+ $activityNote = $this->getTrimmedInput('activityNote', $_POST);
/* Add the activity entry. */
$activityID = $activityEntries->add(
@@ -1390,7 +1388,7 @@ private function _addActivityScheduleEvent($regardingID, $directoryOverride = ''
if ($this->isChecked('scheduleEvent', $_POST))
{
/* Bail out if we received an invalid date. */
- $trimmedDate = $this->getSanitisedInput('dateAdd', $_POST);
+ $trimmedDate = $this->getTrimmedInput('dateAdd', $_POST);
$dateFormatFlag = $_SESSION['CATS']->isDateDMY()
? DATE_FORMAT_DDMMYY
: DATE_FORMAT_MMDDYY;
@@ -1427,7 +1425,7 @@ private function _addActivityScheduleEvent($regardingID, $directoryOverride = ''
$publicEntry = $this->isChecked('publicEntry', $_POST);
$reminderEnabled = $this->isChecked('reminderToggle', $_POST);
- $reminderEmail = $this->getSanitisedInput('sendEmail', $_POST);
+ $reminderEmail = $this->getTrimmedInput('sendEmail', $_POST);
$reminderTime = $this->getTrimmedInput('reminderTime', $_POST);
$duration = -1;
@@ -1486,8 +1484,8 @@ private function _addActivityScheduleEvent($regardingID, $directoryOverride = ''
);
}
- $description = $this->getSanitisedInput('description', $_POST);
- $title = $this->getSanitisedInput('title', $_POST);
+ $description = $this->getTrimmedInput('description', $_POST);
+ $title = $this->getTrimmedInput('title', $_POST);
/* Bail out if any of the required fields are empty. */
if (empty($title))
diff --git a/modules/contacts/Show.tpl b/modules/contacts/Show.tpl
index 79b6927a0..79caa6d8a 100755
--- a/modules/contacts/Show.tpl
+++ b/modules/contacts/Show.tpl
@@ -3,7 +3,7 @@
include_once('./vendor/autoload.php');
use OpenCATS\UI\QuickActionMenu;
?>
-data['firstName'].' '.$this->data['lastName'], array( 'js/activity.js')); ?>
+data['firstName'], ENT_QUOTES, HTML_ENCODING) . ' ' . htmlspecialchars($this->data['lastName'], ENT_QUOTES, HTML_ENCODING), array( 'js/activity.js', 'js/attachment.js')); ?>
active); ?>