diff --git a/db/cats_schema.sql b/db/cats_schema.sql index 5484f266f..268b9319c 100755 --- a/db/cats_schema.sql +++ b/db/cats_schema.sql @@ -850,7 +850,7 @@ insert into `module_schema`(`module_schema_id`,`name`,`version`) values (9,'ext insert into `module_schema`(`module_schema_id`,`name`,`version`) values (10,'graphs',0); insert into `module_schema`(`module_schema_id`,`name`,`version`) values (11,'home',0); insert into `module_schema`(`module_schema_id`,`name`,`version`) values (12,'import',0); -insert into `module_schema`(`module_schema_id`,`name`,`version`) values (13,'install',370); +insert into `module_schema`(`module_schema_id`,`name`,`version`) values (13,'install',371); insert into `module_schema`(`module_schema_id`,`name`,`version`) values (14,'joborders',0); insert into `module_schema`(`module_schema_id`,`name`,`version`) values (15,'lists',0); insert into `module_schema`(`module_schema_id`,`name`,`version`) values (16,'login',0); diff --git a/modules/calendar/Calendar.tpl b/modules/calendar/Calendar.tpl index e180fa3dd..191a7d377 100755 --- a/modules/calendar/Calendar.tpl +++ b/modules/calendar/Calendar.tpl @@ -67,7 +67,7 @@  * @@ -217,7 +217,7 @@  * diff --git a/modules/calendar/CalendarUI.php b/modules/calendar/CalendarUI.php index 7436ef833..a9cf1d6e4 100755 --- a/modules/calendar/CalendarUI.php +++ b/modules/calendar/CalendarUI.php @@ -402,10 +402,10 @@ private function onAddEvent() $publicEntry = $this->isChecked('publicEntry', $_POST); $reminderEnabled = $this->isChecked('reminderToggle', $_POST); - $description = $this->getSanitisedInput('description', $_POST); - $title = $this->getSanitisedInput('title', $_POST); - $reminderEmail = $this->getSanitisedInput('sendEmail', $_POST); - $reminderTime = $this->getSanitisedInput('reminderTime', $_POST); + $description = $this->getTrimmedInput('description', $_POST); + $title = $this->getTrimmedInput('title', $_POST); + $reminderEmail = $this->getTrimmedInput('sendEmail', $_POST); + $reminderTime = $this->getTrimmedInput('reminderTime', $_POST); // FIXME: Reminder time must be an integer! @@ -595,9 +595,9 @@ private function onEditEvent() $publicEntry = $this->isChecked('publicEntry', $_POST); $reminderEnabled = $this->isChecked('reminderToggle', $_POST); - $description = $this->getSanitisedInput('description', $_POST); - $title = $this->getSanitisedInput('title', $_POST); - $reminderEmail = $this->getSanitisedInput('sendEmail', $_POST); + $description = $this->getTrimmedInput('description', $_POST); + $title = $this->getTrimmedInput('title', $_POST); + $reminderEmail = $this->getTrimmedInput('sendEmail', $_POST); $reminderTime = $this->getTrimmedInput('reminderTime', $_POST); // FIXME: Reminder time must be an integer! diff --git a/modules/candidates/CandidatesUI.php b/modules/candidates/CandidatesUI.php index 8aaa11582..d59a034da 100755 --- a/modules/candidates/CandidatesUI.php +++ b/modules/candidates/CandidatesUI.php @@ -986,28 +986,28 @@ public function checkParsingFunctions() // Retain all field data since this isn't done over AJAX (yet) $fields = array( - 'firstName' => $this->getSanitisedInput('firstName', $_POST), - 'middleName' => $this->getSanitisedInput('middleName', $_POST), - 'lastName' => $this->getSanitisedInput('lastName', $_POST), - 'email1' => $this->getSanitisedInput('email1', $_POST), - 'email2' => $this->getSanitisedInput('email2', $_POST), - 'phoneHome' => $this->getSanitisedInput('phoneHome', $_POST), - 'phoneCell' => $this->getSanitisedInput('phoneCell', $_POST), - 'phoneWork' => $this->getSanitisedInput('phoneWork', $_POST), - 'address' => $this->getSanitisedInput('address', $_POST), - 'address2' => $this->getSanitisedInput('address2', $_POST), - 'city' => $this->getSanitisedInput('city', $_POST), - 'state' => $this->getSanitisedInput('state', $_POST), - 'zip' => $this->getSanitisedInput('zip', $_POST), + 'firstName' => $this->getTrimmedInput('firstName', $_POST), + 'middleName' => $this->getTrimmedInput('middleName', $_POST), + 'lastName' => $this->getTrimmedInput('lastName', $_POST), + 'email1' => $this->getTrimmedInput('email1', $_POST), + 'email2' => $this->getTrimmedInput('email2', $_POST), + 'phoneHome' => $this->getTrimmedInput('phoneHome', $_POST), + 'phoneCell' => $this->getTrimmedInput('phoneCell', $_POST), + 'phoneWork' => $this->getTrimmedInput('phoneWork', $_POST), + 'address' => $this->getTrimmedInput('address', $_POST), + 'address2' => $this->getTrimmedInput('address2', $_POST), + 'city' => $this->getTrimmedInput('city', $_POST), + 'state' => $this->getTrimmedInput('state', $_POST), + 'zip' => $this->getTrimmedInput('zip', $_POST), 'source' => $this->getTrimmedInput('source', $_POST), - 'keySkills' => $this->getSanitisedInput('keySkills', $_POST), - 'currentEmployer' => $this->getSanitisedInput('currentEmployer', $_POST), - 'currentPay' => $this->getSanitisedInput('currentPay', $_POST), - 'desiredPay' => $this->getSanitisedInput('desiredPay', $_POST), - 'notes' => $this->getSanitisedInput('notes', $_POST), - 'canRelocate' => $this->getSanitisedInput('canRelocate', $_POST), - 'webSite' => $this->getSanitisedInput('webSite', $_POST), - 'bestTimeToCall' => $this->getSanitisedInput('bestTimeToCall', $_POST), + 'keySkills' => $this->getTrimmedInput('keySkills', $_POST), + 'currentEmployer' => $this->getTrimmedInput('currentEmployer', $_POST), + 'currentPay' => $this->getTrimmedInput('currentPay', $_POST), + 'desiredPay' => $this->getTrimmedInput('desiredPay', $_POST), + 'notes' => $this->getTrimmedInput('notes', $_POST), + 'canRelocate' => $this->getTrimmedInput('canRelocate', $_POST), + 'webSite' => $this->getTrimmedInput('webSite', $_POST), + 'bestTimeToCall' => $this->getTrimmedInput('bestTimeToCall', $_POST), 'gender' => $this->getTrimmedInput('gender', $_POST), 'race' => $this->getTrimmedInput('race', $_POST), 'veteran' => $this->getTrimmedInput('veteran', $_POST), @@ -1287,7 +1287,7 @@ private function onEdit() } $formattedPhoneHome = StringUtility::extractPhoneNumber( - $this->getSanitisedInput('phoneHome', $_POST) + $this->getTrimmedInput('phoneHome', $_POST) ); if (!empty($formattedPhoneHome)) { @@ -1295,11 +1295,11 @@ private function onEdit() } else { - $phoneHome = $this->getSanitisedInput('phoneHome', $_POST); + $phoneHome = $this->getTrimmedInput('phoneHome', $_POST); } $formattedPhoneCell = StringUtility::extractPhoneNumber( - $this->getSanitisedInput('phoneCell', $_POST) + $this->getTrimmedInput('phoneCell', $_POST) ); if (!empty($formattedPhoneCell)) { @@ -1307,11 +1307,11 @@ private function onEdit() } else { - $phoneCell = $this->getSanitisedInput('phoneCell', $_POST); + $phoneCell = $this->getTrimmedInput('phoneCell', $_POST); } $formattedPhoneWork = StringUtility::extractPhoneNumber( - $this->getSanitisedInput('phoneWork', $_POST) + $this->getTrimmedInput('phoneWork', $_POST) ); if (!empty($formattedPhoneWork)) { @@ -1319,7 +1319,7 @@ private function onEdit() } else { - $phoneWork = $this->getSanitisedInput('phoneWork', $_POST); + $phoneWork = $this->getTrimmedInput('phoneWork', $_POST); } $candidateID = $_POST['candidateID']; @@ -1392,23 +1392,23 @@ private function onEdit() } $isActive = $this->isChecked('isActive', $_POST); - $firstName = $this->getSanitisedInput('firstName', $_POST); - $middleName = $this->getSanitisedInput('middleName', $_POST); - $lastName = $this->getSanitisedInput('lastName', $_POST); - $email1 = $this->getSanitisedInput('email1', $_POST); - $email2 = $this->getSanitisedInput('email2', $_POST); - $address = $this->getSanitisedInput('address', $_POST); - $address2 = $this->getSanitisedInput('address2', $_POST); - $city = $this->getSanitisedInput('city', $_POST); - $state = $this->getSanitisedInput('state', $_POST); - $zip = $this->getSanitisedInput('zip', $_POST); - $source = $this->getSanitisedInput('source', $_POST); - $keySkills = $this->getSanitisedInput('keySkills', $_POST); - $currentEmployer = $this->getSanitisedInput('currentEmployer', $_POST); - $currentPay = $this->getSanitisedInput('currentPay', $_POST); - $desiredPay = $this->getSanitisedInput('desiredPay', $_POST); - $notes = $this->getSanitisedInput('notes', $_POST); - $webSite = $this->getSanitisedInput('webSite', $_POST); + $firstName = $this->getTrimmedInput('firstName', $_POST); + $middleName = $this->getTrimmedInput('middleName', $_POST); + $lastName = $this->getTrimmedInput('lastName', $_POST); + $email1 = $this->getTrimmedInput('email1', $_POST); + $email2 = $this->getTrimmedInput('email2', $_POST); + $address = $this->getTrimmedInput('address', $_POST); + $address2 = $this->getTrimmedInput('address2', $_POST); + $city = $this->getTrimmedInput('city', $_POST); + $state = $this->getTrimmedInput('state', $_POST); + $zip = $this->getTrimmedInput('zip', $_POST); + $source = $this->getTrimmedInput('source', $_POST); + $keySkills = $this->getTrimmedInput('keySkills', $_POST); + $currentEmployer = $this->getTrimmedInput('currentEmployer', $_POST); + $currentPay = $this->getTrimmedInput('currentPay', $_POST); + $desiredPay = $this->getTrimmedInput('desiredPay', $_POST); + $notes = $this->getTrimmedInput('notes', $_POST); + $webSite = $this->getTrimmedInput('webSite', $_POST); $bestTimeToCall = $this->getTrimmedInput('bestTimeToCall', $_POST); $gender = $this->getTrimmedInput('gender', $_POST); $race = $this->getTrimmedInput('race', $_POST); diff --git a/modules/candidates/Show.tpl b/modules/candidates/Show.tpl index ab1a343a0..9ec74c9d5 100755 --- a/modules/candidates/Show.tpl +++ b/modules/candidates/Show.tpl @@ -4,9 +4,9 @@ use OpenCATS\UI\CandidateQuickActionMenu; use OpenCATS\UI\CandidateDuplicateQuickActionMenu; ?> isPopup): ?> - data['firstName'].' '.$this->data['lastName'], array( 'js/activity.js', 'js/sorttable.js', 'js/match.js', 'js/lib.js', 'js/pipeline.js', 'modules/candidates/quickAction-candidates.js')); ?> + data['firstName'], ENT_QUOTES, HTML_ENCODING) . ' ' . htmlspecialchars($this->data['lastName'], ENT_QUOTES, HTML_ENCODING), array( 'js/activity.js', 'js/sorttable.js', 'js/match.js', 'js/lib.js', 'js/pipeline.js', 'js/attachment.js', 'modules/candidates/quickAction-candidates.js')); ?> - data['firstName'].' '.$this->data['lastName'], array( 'js/activity.js', 'js/sorttable.js', 'js/match.js', 'js/lib.js', 'js/pipeline.js', 'modules/candidates/quickAction-candidates.js', 'modules/candidates/quickAction-duplicates.js')); ?> + data['firstName'], ENT_QUOTES, HTML_ENCODING) . ' ' . htmlspecialchars($this->data['lastName'], ENT_QUOTES, HTML_ENCODING), array( 'js/activity.js', 'js/sorttable.js', 'js/match.js', 'js/lib.js', 'js/pipeline.js', 'js/attachment.js', 'modules/candidates/quickAction-candidates.js', 'modules/candidates/quickAction-duplicates.js')); ?> active); ?> @@ -614,7 +614,7 @@ use OpenCATS\UI\CandidateDuplicateQuickActionMenu; lists as $rowNumber => $list): ?> - + _($list['name']); ?> diff --git a/modules/careers/CareersUI.php b/modules/careers/CareersUI.php index f592f785c..9097a93d7 100755 --- a/modules/careers/CareersUI.php +++ b/modules/careers/CareersUI.php @@ -1511,7 +1511,8 @@ private function onApplyToJobOrder($siteID, $candidateID = false) return; } - /* funciton getSanitisedInput used to fix XSS vuln in public portal */ + // NOTE: Careers Portal renders these values into HTML without consistent output escaping. + // TODO (security/xss-hardening): Escape attributes/textarea/title consistently, then switch to getTrimmedInput(). $lastName = $this->getSanitisedInput('lastName', $_POST); $middleName = $this->getSanitisedInput('middleName', $_POST); $firstName = $this->getSanitisedInput('firstName', $_POST); diff --git a/modules/companies/CompaniesUI.php b/modules/companies/CompaniesUI.php index 49f23e287..b551aa243 100755 --- a/modules/companies/CompaniesUI.php +++ b/modules/companies/CompaniesUI.php @@ -544,7 +544,7 @@ private function add() private function onAdd() { $formattedPhone1 = StringUtility::extractPhoneNumber( - $this->getSanitisedInput('phone1', $_POST) + $this->getTrimmedInput('phone1', $_POST) ); if (!empty($formattedPhone1)) { @@ -552,11 +552,11 @@ private function onAdd() } else { - $phone1 = $this->getSanitisedInput('phone1', $_POST); + $phone1 = $this->getTrimmedInput('phone1', $_POST); } $formattedPhone2 = StringUtility::extractPhoneNumber( - $this->getSanitisedInput('phone2', $_POST) + $this->getTrimmedInput('phone2', $_POST) ); if (!empty($formattedPhone2)) { @@ -564,11 +564,11 @@ private function onAdd() } else { - $phone2 = $this->getSanitisedInput('phone2', $_POST); + $phone2 = $this->getTrimmedInput('phone2', $_POST); } $formattedFaxNumber = StringUtility::extractPhoneNumber( - $this->getSanitisedInput('faxNumber', $_POST) + $this->getTrimmedInput('faxNumber', $_POST) ); if (!empty($formattedFaxNumber)) { @@ -576,10 +576,10 @@ private function onAdd() } else { - $faxNumber = $this->getSanitisedInput('faxNumber', $_POST); + $faxNumber = $this->getTrimmedInput('faxNumber', $_POST); } - $url = $this->getSanitisedInput('url', $_POST); + $url = $this->getTrimmedInput('url', $_POST); if (!empty($url)) { $formattedURL = StringUtility::extractURL($url); @@ -593,14 +593,14 @@ private function onAdd() /* Hot company? */ $isHot = $this->isChecked('isHot', $_POST); - $name = $this->getSanitisedInput('name', $_POST); - $address = $this->getSanitisedInput('address', $_POST); - $address2 = $this->getSanitisedInput('address2', $_POST); - $city = $this->getSanitisedInput('city', $_POST); - $state = $this->getSanitisedInput('state', $_POST); - $zip = $this->getSanitisedInput('zip', $_POST); - $keyTechnologies = $this->getSanitisedInput('keyTechnologies', $_POST); - $notes = $this->getSanitisedInput('notes', $_POST); + $name = $this->getTrimmedInput('name', $_POST); + $address = $this->getTrimmedInput('address', $_POST); + $address2 = $this->getTrimmedInput('address2', $_POST); + $city = $this->getTrimmedInput('city', $_POST); + $state = $this->getTrimmedInput('state', $_POST); + $zip = $this->getTrimmedInput('zip', $_POST); + $keyTechnologies = $this->getTrimmedInput('keyTechnologies', $_POST); + $notes = $this->getTrimmedInput('notes', $_POST); /* Departments list editor. */ $departmentsCSV = $this->getTrimmedInput('departmentsCSV', $_POST); @@ -753,7 +753,7 @@ private function onEdit() } $formattedPhone1 = StringUtility::extractPhoneNumber( - $this->getSanitisedInput('phone1', $_POST) + $this->getTrimmedInput('phone1', $_POST) ); if (!empty($formattedPhone1)) { @@ -761,11 +761,11 @@ private function onEdit() } else { - $phone1 = $this->getSanitisedInput('phone1', $_POST); + $phone1 = $this->getTrimmedInput('phone1', $_POST); } $formattedPhone2 = StringUtility::extractPhoneNumber( - $this->getSanitisedInput('phone2', $_POST) + $this->getTrimmedInput('phone2', $_POST) ); if (!empty($formattedPhone2)) { @@ -773,11 +773,11 @@ private function onEdit() } else { - $phone2 = $this->getSanitisedInput('phone2', $_POST); + $phone2 = $this->getTrimmedInput('phone2', $_POST); } $formattedFaxNumber = StringUtility::extractPhoneNumber( - $this->getSanitisedInput('faxNumber', $_POST) + $this->getTrimmedInput('faxNumber', $_POST) ); if (!empty($formattedFaxNumber)) { @@ -785,10 +785,10 @@ private function onEdit() } else { - $faxNumber = $this->getSanitisedInput('faxNumber', $_POST); + $faxNumber = $this->getTrimmedInput('faxNumber', $_POST); } - $url = $this->getSanitisedInput('url', $_POST); + $url = $this->getTrimmedInput('url', $_POST); if (!empty($url)) { $formattedURL = StringUtility::extractURL($url); @@ -865,14 +865,14 @@ private function onEdit() $emailAddress = ''; } - $name = $this->getSanitisedInput('name', $_POST); - $address = $this->getSanitisedInput('address', $_POST); - $address2 = $this->getSanitisedInput('address2', $_POST); - $city = $this->getSanitisedInput('city', $_POST); - $state = $this->getSanitisedInput('state', $_POST); - $zip = $this->getSanitisedInput('zip', $_POST); - $keyTechnologies = $this->getSanitisedInput('keyTechnologies', $_POST); - $notes = $this->getSanitisedInput('notes', $_POST); + $name = $this->getTrimmedInput('name', $_POST); + $address = $this->getTrimmedInput('address', $_POST); + $address2 = $this->getTrimmedInput('address2', $_POST); + $city = $this->getTrimmedInput('city', $_POST); + $state = $this->getTrimmedInput('state', $_POST); + $zip = $this->getTrimmedInput('zip', $_POST); + $keyTechnologies = $this->getTrimmedInput('keyTechnologies', $_POST); + $notes = $this->getTrimmedInput('notes', $_POST); /* Departments list editor. */ $departmentsCSV = $this->getTrimmedInput('departmentsCSV', $_POST); diff --git a/modules/companies/Show.tpl b/modules/companies/Show.tpl index 86ec6a545..e016fba47 100755 --- a/modules/companies/Show.tpl +++ b/modules/companies/Show.tpl @@ -2,7 +2,7 @@ include_once('./vendor/autoload.php'); use OpenCATS\UI\QuickActionMenu; ?> -data['name'], array( 'js/activity.js', 'js/sorttable.js')); ?> +data['name'], ENT_QUOTES, HTML_ENCODING), array( 'js/activity.js', 'js/sorttable.js', 'js/attachment.js')); ?> active); ?>
diff --git a/modules/contacts/ContactsUI.php b/modules/contacts/ContactsUI.php index 76f739e2a..9196c473c 100755 --- a/modules/contacts/ContactsUI.php +++ b/modules/contacts/ContactsUI.php @@ -488,7 +488,7 @@ private function onAdd() } $formattedPhoneWork = StringUtility::extractPhoneNumber( - $this->getSanitisedInput('phoneWork', $_POST) + $this->getTrimmedInput('phoneWork', $_POST) ); if (!empty($formattedPhoneWork)) { @@ -496,11 +496,11 @@ private function onAdd() } else { - $phoneWork = $this->getSanitisedInput('phoneWork', $_POST); + $phoneWork = $this->getTrimmedInput('phoneWork', $_POST); } $formattedPhoneCell = StringUtility::extractPhoneNumber( - $this->getSanitisedInput('phoneCell', $_POST) + $this->getTrimmedInput('phoneCell', $_POST) ); if (!empty($formattedPhoneCell)) { @@ -508,11 +508,11 @@ private function onAdd() } else { - $phoneCell = $this->getSanitisedInput('phoneCell', $_POST); + $phoneCell = $this->getTrimmedInput('phoneCell', $_POST); } $formattedPhoneOther = StringUtility::extractPhoneNumber( - $this->getSanitisedInput('phoneOther', $_POST) + $this->getTrimmedInput('phoneOther', $_POST) ); if (!empty($formattedPhoneOther)) { @@ -520,24 +520,24 @@ private function onAdd() } else { - $phoneOther = $this->getSanitisedInput('phoneOther', $_POST); + $phoneOther = $this->getTrimmedInput('phoneOther', $_POST); } $companyID = $_POST['companyID']; - $firstName = $this->getSanitisedInput('firstName', $_POST); - $lastName = $this->getSanitisedInput('lastName', $_POST); - $title = $this->getSanitisedInput('title', $_POST); + $firstName = $this->getTrimmedInput('firstName', $_POST); + $lastName = $this->getTrimmedInput('lastName', $_POST); + $title = $this->getTrimmedInput('title', $_POST); $department = $this->getTrimmedInput('department', $_POST); $reportsTo = $this->getTrimmedInput('reportsTo', $_POST); - $email1 = $this->getSanitisedInput('email1', $_POST); - $email2 = $this->getSanitisedInput('email2', $_POST); - $address = $this->getSanitisedInput('address', $_POST); - $address2 = $this->getSanitisedInput('address2', $_POST); - $city = $this->getSanitisedInput('city', $_POST); - $state = $this->getSanitisedInput('state', $_POST); - $zip = $this->getSanitisedInput('zip', $_POST); - $notes = $this->getSanitisedInput('notes', $_POST); + $email1 = $this->getTrimmedInput('email1', $_POST); + $email2 = $this->getTrimmedInput('email2', $_POST); + $address = $this->getTrimmedInput('address', $_POST); + $address2 = $this->getTrimmedInput('address2', $_POST); + $city = $this->getTrimmedInput('city', $_POST); + $state = $this->getTrimmedInput('state', $_POST); + $zip = $this->getTrimmedInput('zip', $_POST); + $notes = $this->getTrimmedInput('notes', $_POST); /* Hot contact? */ $isHot = $this->isChecked('isHot', $_POST); @@ -715,7 +715,7 @@ private function onEdit() $owner = $_POST['owner']; $formattedPhoneWork = StringUtility::extractPhoneNumber( - $this->getSanitisedInput('phoneWork', $_POST) + $this->getTrimmedInput('phoneWork', $_POST) ); if (!empty($formattedPhoneWork)) { @@ -723,11 +723,11 @@ private function onEdit() } else { - $phoneWork = $this->getSanitisedInput('phoneWork', $_POST); + $phoneWork = $this->getTrimmedInput('phoneWork', $_POST); } $formattedPhoneCell = StringUtility::extractPhoneNumber( - $this->getSanitisedInput('phoneCell', $_POST) + $this->getTrimmedInput('phoneCell', $_POST) ); if (!empty($formattedPhoneCell)) { @@ -735,11 +735,11 @@ private function onEdit() } else { - $phoneCell = $this->getSanitisedInput('phoneCell', $_POST); + $phoneCell = $this->getTrimmedInput('phoneCell', $_POST); } $formattedPhoneOther = StringUtility::extractPhoneNumber( - $this->getSanitisedInput('phoneOther', $_POST) + $this->getTrimmedInput('phoneOther', $_POST) ); if (!empty($formattedPhoneOther)) { @@ -747,7 +747,7 @@ private function onEdit() } else { - $phoneOther = $this->getSanitisedInput('phoneOther', $_POST); + $phoneOther = $this->getTrimmedInput('phoneOther', $_POST); } $contacts = new Contacts($this->_siteID); @@ -814,19 +814,19 @@ private function onEdit() $emailAddress = ''; } - $firstName = $this->getSanitisedInput('firstName', $_POST); - $lastName = $this->getSanitisedInput('lastName', $_POST); - $title = $this->getSanitisedInput('title', $_POST); + $firstName = $this->getTrimmedInput('firstName', $_POST); + $lastName = $this->getTrimmedInput('lastName', $_POST); + $title = $this->getTrimmedInput('title', $_POST); $department = $this->getTrimmedInput('department', $_POST); $reportsTo = $this->getTrimmedInput('reportsTo', $_POST); - $email1 = $this->getSanitisedInput('email1', $_POST); - $email2 = $this->getSanitisedInput('email2', $_POST); - $address = $this->getSanitisedInput('address', $_POST); - $address2 = $this->getSanitisedInput('address2', $_POST); - $city = $this->getSanitisedInput('city', $_POST); - $state = $this->getSanitisedInput('state', $_POST); - $zip = $this->getSanitisedInput('zip', $_POST); - $notes = $this->getSanitisedInput('notes', $_POST); + $email1 = $this->getTrimmedInput('email1', $_POST); + $email2 = $this->getTrimmedInput('email2', $_POST); + $address = $this->getTrimmedInput('address', $_POST); + $address2 = $this->getTrimmedInput('address2', $_POST); + $city = $this->getTrimmedInput('city', $_POST); + $state = $this->getTrimmedInput('state', $_POST); + $zip = $this->getTrimmedInput('zip', $_POST); + $notes = $this->getTrimmedInput('notes', $_POST); $isHot = $this->isChecked('isHot', $_POST); $leftCompany = $this->isChecked('leftCompany', $_POST); @@ -1361,9 +1361,7 @@ private function _addActivityScheduleEvent($regardingID, $directoryOverride = '' CommonErrors::fatalModal(COMMONERROR_BADINDEX, $this, 'Invalid activity type ID.'); } - $activityNote = $this->getSanitisedInput('activityNote', $_POST); - - $activityNote = htmlspecialchars($activityNote); + $activityNote = $this->getTrimmedInput('activityNote', $_POST); /* Add the activity entry. */ $activityID = $activityEntries->add( @@ -1390,7 +1388,7 @@ private function _addActivityScheduleEvent($regardingID, $directoryOverride = '' if ($this->isChecked('scheduleEvent', $_POST)) { /* Bail out if we received an invalid date. */ - $trimmedDate = $this->getSanitisedInput('dateAdd', $_POST); + $trimmedDate = $this->getTrimmedInput('dateAdd', $_POST); $dateFormatFlag = $_SESSION['CATS']->isDateDMY() ? DATE_FORMAT_DDMMYY : DATE_FORMAT_MMDDYY; @@ -1427,7 +1425,7 @@ private function _addActivityScheduleEvent($regardingID, $directoryOverride = '' $publicEntry = $this->isChecked('publicEntry', $_POST); $reminderEnabled = $this->isChecked('reminderToggle', $_POST); - $reminderEmail = $this->getSanitisedInput('sendEmail', $_POST); + $reminderEmail = $this->getTrimmedInput('sendEmail', $_POST); $reminderTime = $this->getTrimmedInput('reminderTime', $_POST); $duration = -1; @@ -1486,8 +1484,8 @@ private function _addActivityScheduleEvent($regardingID, $directoryOverride = '' ); } - $description = $this->getSanitisedInput('description', $_POST); - $title = $this->getSanitisedInput('title', $_POST); + $description = $this->getTrimmedInput('description', $_POST); + $title = $this->getTrimmedInput('title', $_POST); /* Bail out if any of the required fields are empty. */ if (empty($title)) diff --git a/modules/contacts/Show.tpl b/modules/contacts/Show.tpl index 79b6927a0..79caa6d8a 100755 --- a/modules/contacts/Show.tpl +++ b/modules/contacts/Show.tpl @@ -3,7 +3,7 @@ include_once('./vendor/autoload.php'); use OpenCATS\UI\QuickActionMenu; ?> -data['firstName'].' '.$this->data['lastName'], array( 'js/activity.js')); ?> +data['firstName'], ENT_QUOTES, HTML_ENCODING) . ' ' . htmlspecialchars($this->data['lastName'], ENT_QUOTES, HTML_ENCODING), array( 'js/activity.js', 'js/attachment.js')); ?> active); ?>