diff --git a/interface/lib/classes/listform.inc.php b/interface/lib/classes/listform.inc.php
index 4999f7e5427b631a8e964a68791cba091a804376..15a1a53add169892e4aaba3e1b7d4dcb775d398c 100644
--- a/interface/lib/classes/listform.inc.php
+++ b/interface/lib/classes/listform.inc.php
@@ -179,6 +179,7 @@ class listform {
&& $k == $_SESSION['search'][$list_name][$search_prefix.$field]
&& $_SESSION['search'][$list_name][$search_prefix.$field] != '')
? ' SELECTED' : '';
+ $v = $app->functions->htmlentities($v);
$out .= "\r\n";
}
}
@@ -610,17 +611,8 @@ class listform {
}
function escapeArrayValues($search_values) {
- global $conf;
-
- $out = array();
- if(is_array($search_values)) {
- foreach($search_values as $key => $val) {
- $out[$key] = htmlentities($val, ENT_QUOTES, $conf["html_content_encoding"]);
- }
- }
-
- return $out;
-
+ global $app;
+ return $app->functions->htmlentities($search_values);
}
}
diff --git a/interface/lib/classes/quota_lib.inc.php b/interface/lib/classes/quota_lib.inc.php
index 93d8baa5de2cb21154125737e87f400764f81595..e5d55ff80c17c00354fa6001d6add5c49def61a5 100644
--- a/interface/lib/classes/quota_lib.inc.php
+++ b/interface/lib/classes/quota_lib.inc.php
@@ -243,7 +243,8 @@ class quota_lib {
if(is_array($emails) && !empty($emails)){
for($i=0;$ifunctions->htmlentities($emails[$i]['name']);
$emails[$i]['used'] = isset($monitor_data[$email]['used']) ? $monitor_data[$email]['used'] : array(1 => 0);
if (!is_numeric($emails[$i]['used'])) $emails[$i]['used']=$emails[$i]['used'][1];
diff --git a/interface/lib/classes/tform_base.inc.php b/interface/lib/classes/tform_base.inc.php
index c60321bd8f5f6b2cbae2d767fbd6108abccf77d6..06c016f25c3c568ac00f958e3f920a71e2255a19 100644
--- a/interface/lib/classes/tform_base.inc.php
+++ b/interface/lib/classes/tform_base.inc.php
@@ -475,6 +475,7 @@ class tform_base {
$selected = ($k == $val)?' SELECTED':'';
if(isset($this->wordbook[$v]))
$v = $this->wordbook[$v];
+ $v = $app->functions->htmlentities($v);
$out .= "\r\n";
}
}
@@ -494,7 +495,7 @@ class tform_base {
foreach($vals as $tvl) {
if(trim($tvl) == trim($k)) $selected = ' SELECTED';
}
-
+ $v = $app->functions->htmlentities($v);
$out .= "\r\n";
}
}
@@ -577,7 +578,7 @@ class tform_base {
default:
if(isset($record[$key])) {
- $new_record[$key] = htmlspecialchars($record[$key]);
+ $new_record[$key] = $app->functions->htmlentities($record[$key]);
} else {
$new_record[$key] = '';
}
@@ -608,7 +609,8 @@ class tform_base {
$out = '';
foreach($field['value'] as $k => $v) {
$selected = ($k == $field["default"])?' SELECTED':'';
- $out .= "\r\n";
+ $v = $app->functions->htmlentities($this->lng($v));
+ $out .= "\r\n";
}
}
if(isset($out)) $new_record[$key] = $out;
@@ -622,7 +624,7 @@ class tform_base {
// HTML schreiben
$out = '';
foreach($field['value'] as $k => $v) {
-
+ $v = $app->functions->htmlentities($v);
$out .= "\r\n";
}
}
@@ -693,7 +695,7 @@ class tform_base {
break;
default:
- $new_record[$key] = htmlspecialchars($field['default']);
+ $new_record[$key] = $app->functions->htmlentities($field['default']);
}
}
@@ -911,6 +913,12 @@ class tform_base {
case 'NOWHITESPACE':
$returnval = preg_replace('/\s+/', '', $returnval);
break;
+ case 'STRIPTAGS':
+ $returnval = strip_tags(preg_replace('/