Escape vote questions in HTML display

Admin vote questions are now properly escaped. All strings input by users should be escaped! Also removed escaping of int `$Days` since only strings can be escaped.
smrealms · Sep 28, 2023 · fd8f165 · fd8f165
1 parent 1636bed
commit fd8f165
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 6 deletions.
diff --git a/src/templates/Default/engine/Default/admin/vote_create.php b/src/templates/Default/engine/Default/admin/vote_create.php
@@ -1,9 +1,13 @@
 <?php declare(strict_types=1);
 
-if (isset($PreviewVote)) { ?><table class="standard"><tr><td><?php echo bbify($PreviewVote); ?></td></tr></table><?php } ?>
+/**
+ * @var ?int $Days
+ */
+
+if (isset($PreviewVote)) { ?><table class="standard"><tr><td><?php echo bbify(htmlentities($PreviewVote)); ?></td></tr></table><?php } ?>
 <form name="VoteForm" method="POST" action="<?php echo $VoteFormHREF; ?>">
-	Question: <input type="text" name="question" required value="<?php if (isset($PreviewVote)) { echo htmlspecialchars($PreviewVote); } ?>" /><br />
-	Days to end: <input type="number" name="days" required value="<?php if (isset($Days)) { echo htmlspecialchars($Days); } ?>" /><br />
+	Question: <input type="text" name="question" required value="<?php if (isset($PreviewVote)) { echo bbify(htmlentities($PreviewVote)); } ?>" /><br />
+	Days to end: <input type="number" name="days" required value="<?php if (isset($Days)) { echo $Days; } ?>" /><br />
 	<input type="submit" name="action" value="Create Vote" />&nbsp;<input type="submit" name="action" value="Preview Vote" />
 </form>
 <br /><br />
@@ -12,7 +16,7 @@
 <form name="VoteForm" method="POST" action="<?php echo $VoteFormHREF; ?>">
 	Vote: <select id="vote" name="vote"><?php
 		foreach ($CurrentVotes as $CurrentVote) {
-			?><option value="<?php echo $CurrentVote['ID']; ?>"<?php if (isset($VoteID) && $CurrentVote['ID'] === $VoteID) { ?>selected="selected"<?php } ?>><?php echo bbify($CurrentVote['Question']); ?></option><?php
+			?><option value="<?php echo $CurrentVote['ID']; ?>"<?php if (isset($VoteID) && $CurrentVote['ID'] === $VoteID) { ?>selected="selected"<?php } ?>><?php echo bbify(htmlentities($CurrentVote['Question'])); ?></option><?php
 		} ?>
 	</select><br />
 	Option: <input type="text" name="option" required value="<?php if (isset($PreviewOption)) { echo htmlspecialchars($PreviewOption); } ?>" /><br />

diff --git a/src/templates/Default/engine/Default/game_play.php b/src/templates/Default/engine/Default/game_play.php
@@ -96,7 +96,7 @@
 	foreach ($Voting as $Vote) {
 		?><br /><br />
 		<form name="FORM" method="POST" action="<?php echo $Vote['HREF'] ?>">
-			<span class="bold"><?php echo bbify($Vote['Question']); ?></span> (<?php echo $Vote['TimeRemaining']; ?> Remaining)<br /><?php
+			<span class="bold"><?php echo bbify(htmlentities($Vote['Question'])); ?></span> (<?php echo $Vote['TimeRemaining']; ?> Remaining)<br /><?php
 			foreach ($Vote['Options'] as $VoteOption) { ?>
 				<input type="radio" name="vote" required value="<?php echo $VoteOption['ID']; ?>"<?php if ($VoteOption['Chosen']) { ?> checked<?php } ?>><?php echo bbify($VoteOption['Text']); ?> (<?php echo $VoteOption['Votes']; ?> votes)<br /><?php
 			} ?>

diff --git a/src/templates/Default/engine/Default/vote.php b/src/templates/Default/engine/Default/vote.php
@@ -5,7 +5,7 @@
 	foreach ($Voting as $Vote) {
 		?><br /><br />
 		<form name="FORM" method="POST" action="<?php echo $Vote['HREF'] ?>">
-			<span class="bold"><?php echo bbify($Vote['Question']); ?></span> <?php if (isset($Vote['TimeRemaining'])) { ?>(<?php echo $Vote['TimeRemaining']; ?> Remaining)<?php } else { ?>(Ended <?php echo $Vote['EndDate']; ?>)<?php } ?><br /><?php
+			<span class="bold"><?php echo bbify(htmlentities($Vote['Question'])); ?></span> <?php if (isset($Vote['TimeRemaining'])) { ?>(<?php echo $Vote['TimeRemaining']; ?> Remaining)<?php } else { ?>(Ended <?php echo $Vote['EndDate']; ?>)<?php } ?><br /><?php
 			foreach ($Vote['Options'] as $VoteOption) { ?>
 				<input type="radio" name="vote" <?php if (!isset($Vote['TimeRemaining'])) { ?>disabled="disabled" <?php } ?>value="<?php echo $VoteOption['ID']; ?>"<?php if ($VoteOption['Chosen']) { ?> checked<?php } ?>><?php echo bbify($VoteOption['Text']); ?> (<?php echo $VoteOption['Votes']; ?> votes)<br /><?php
 			} ?>