← All changes | controllers/template.php +17 -54 trunk → 11.2 View file →

		@@ -9,11 +9,11 @@
9	9	// import dependencies.
10	10	cssJSToolbox::import('framework:mvc:controller-ajax.inc.php');
11	11
12	12	/**
13		-*
	13	+*
14	14	* DESCRIPTION
15		-*
	15	+*
16	16	* @author ??
17	17	* @version ??
18	18	*/
19	19	class CJTTemplateController extends CJTAjaxController {
		@@ -19,24 +19,24 @@
19	19	class CJTTemplateController extends CJTAjaxController {
20	20
21	21	/**
22	22	* put your comment there...
23		- *
	23	+ *
24	24	* @var mixed
25	25	*/
26	26	protected $controllerInfo = array('model' => 'template');
27		-
	27	+
28	28	/**
29	29	* put your comment there...
30		- *
	30	+ *
31	31	* @var mixed
32	32	*/
33	33	protected $onsave = array('parameters' => array('data'));
34		-
	34	+
35	35	/**
36		- *
	36	+ *
37	37	* Initialize new object.
38		- *
	38	+ *
39	39	* @return void
40	40	*/
41	41	public function __construct() {
42	42	// Initialize parent!
		@@ -49,9 +49,9 @@
49	49	}
50	50
51	51	/**
52	52	* put your comment there...
53		- *
	53	+ *
54	54	*/
55	55	protected function editAction() {
56	56	$this->model->inputs['id'] = (int) $_REQUEST['id'];
57	57	// Display the view.
		@@ -56,12 +56,12 @@
56	56	$this->model->inputs['id'] = (int) $_REQUEST['id'];
57	57	// Display the view.
58	58	parent::displayAction();
59	59	}
60		-
	60	+
61	61	/**
62	62	* put your comment there...
63		- *
	63	+ *
64	64	*/
65	65	protected function getTemplateByAction() {
66	66	// Initialize.
67	67	$returns = array_flip($_GET['returns']);
		@@ -70,12 +70,12 @@
70	70	$inputs['filter'] = $_GET['filter'];
71	71	// Query Block.
72	72	$this->response = array_intersect_key((array) $this->model->getTemplateBy(), $returns);
73	73	}
74		-
	74	+
75	75	/**
76	76	* put your comment there...
77		- *
	77	+ *
78	78	*/
79	79	protected function infoAction() {
80	80	$this->model->inputs['id'] = (int) $_REQUEST['id'];
81	81	// Display the view.
		@@ -80,54 +80,16 @@
80	80	$this->model->inputs['id'] = (int) $_REQUEST['id'];
81	81	// Display the view.
82	82	parent::displayAction();
83	83	}
84		-
	84	+
85	85	/**
86		- * Save template data with proper sanitization to prevent XSS attacks.
87		- *
88		- * Security Fix: Sanitizes all user inputs (description, keywords, name, changeLog, version)
89		- * to prevent Stored XSS vulnerabilities. This addresses the security issue where malicious
90		- * scripts could be injected through template fields and executed when viewing the Templates
91		- * Manager page, Template Lookup feature, or when using the Embed/Link Templates functionality.
92		- *
93		- * @security CVE Reference: Stored XSS in template save endpoint
	86	+ * put your comment there...
	87	+ *
94	88	*/
95	89	protected function saveAction() {
96	90	// Read inputs
97	91	$item = filter_input(INPUT_POST, 'item', FILTER_UNSAFE_RAW, FILTER_REQUIRE_ARRAY);
98		-
99		- // Sanitize template fields to prevent XSS
100		- if (isset($item['template'])) {
101		- // Sanitize description field - strip all HTML tags
102		- if (isset($item['template']['description'])) {
103		- $item['template']['description'] = sanitize_textarea_field($item['template']['description']);
104		- }
105		-
106		- // Sanitize keywords field - strip all HTML tags
107		- if (isset($item['template']['keywords'])) {
108		- $item['template']['keywords'] = sanitize_textarea_field($item['template']['keywords']);
109		- }
110		-
111		- // Sanitize name field
112		- if (isset($item['template']['name'])) {
113		- $item['template']['name'] = sanitize_text_field($item['template']['name']);
114		- }
115		- }
116		-
117		- // Sanitize revision fields
118		- if (isset($item['revision'])) {
119		- // Sanitize changeLog field
120		- if (isset($item['revision']['changeLog'])) {
121		- $item['revision']['changeLog'] = sanitize_textarea_field($item['revision']['changeLog']);
122		- }
123		-
124		- // Sanitize version field
125		- if (isset($item['revision']['version'])) {
126		- $item['revision']['version'] = sanitize_text_field($item['revision']['version']);
127		- }
128		- }
129		-
130	92	// Posted template data is in the item array, the others is just for making the request!
131	93	$this->model->inputs['item'] = $this->onsave($item);
132	94	if ($revision = $this->model->save()) {
133	95	$this->response = array('revision' => $revision);
		@@ -132,8 +94,9 @@
132	94	if ($revision = $this->model->save()) {
133	95	$this->response = array('revision' => $revision);
134	96	}
135	97	}
	98	+
136	99	} // End class.
137	100
138	101	// Hookable!
139	102	CJTTemplateController::define('CJTTemplateController', array('hookType' => CJTWordpressEvents::HOOK_FILTER));