Item7832: Sanitation of form fields

TWiki:Main/PeterThoeny

Fix:

Index: data/Main/ChangeProfilePicture.txt
===================================================================
--- data/Main/ChangeProfilePicture.txt   (revision 30410)
+++ data/Main/ChangeProfilePicture.txt   (working copy)
@@ -1,4 +1,4 @@
-%META:TOPICINFO{author="TWikiContributor" date="1401491605" format="1.1" version="$Rev$"}%
+%META:TOPICINFO{author="TWikiContributor" date="1514787124" format="1.1" version="$Rev$"}%
 ---+ %MAKETEXT{"Change Profile Picture of [_1]" args="%URLPARAM{ "wikiname" default=" " }%" }%
 
 <!--<pre>-->
@@ -112,7 +112,7 @@
 <div class="profileHeader">
 %MAKETEXT{"Current picture"}%:
 </div>
-%CALCULATE{$SET(current-image, %FORMFIELD{ "Image" topic="%URLPARAM{wikiname}%" }%)}%<nop>
+%CALCULATE{$SET(current-image, %FORMFIELD{ "Image" topic="%URLPARAM{wikiname}%" encode="safe" }%)}%<nop>
 <img %IF{
  "'%URLPARAM{wikiname}%'/attachments[name='%CALCULATE{$GET(current-image)}%']"
  then='src="%PUBURLPATH%/%WEB%/%URLPARAM{wikiname}%/%CALCULATE{$GET(current-image)}%" title="%CALCULATE{$GET(cur
rent-image)}%"'
Index: data/Main/UserProfileHeader.txt
===================================================================
--- data/Main/UserProfileHeader.txt   (revision 30410)
+++ data/Main/UserProfileHeader.txt   (working copy)
@@ -1,9 +1,9 @@
-%META:TOPICINFO{author="TWikiContributor" date="1413362552" format="1.1" version="$Rev$"}%
+%META:TOPICINFO{author="TWikiContributor" date="1514787116" format="1.1" version="$Rev$"}%
 ---+ Header of User Profile Pages
 
 __Note:__ This is a maintenance topic, used by the TWiki Administrator.
 
-The part between the horizontal rules gets included at the top of every [[%WIKIUSERSTOPIC%]] profile page. The h
eader can be customized to the needs of your organization. The TWiki:TWiki.UserHomepageSupplement has some additi
onal documentation and ideas on customizing the user profile pages.
+The part between the horizontal rules gets included at the top of every [[%WIKIUSERSTOPIC%]] profile page. The h
eader can be customized to the needs of your organization. The TWiki:TWiki.UserHomepageSupplement has some additi
onal documentation and ideas on customizing the user profile pages. __If you customize this topic make sure to re
apply the changes after a TWiki upgrade.__
 
 -----
 %STARTINCLUDE%
@@ -56,7 +56,7 @@
 <a href="%SCRIPTURL{viewauth}%/%WEB%/ChangeProfilePicture?wikiname=%INCLUDINGTOPIC%" title="%MAKETEXT{"Change pr
ofile picture"}%" class="changePicture" rel="nofollow">&nbsp;<img src='%ICONURLPATH{uweb-bo12}%' width='12' heigh
t='12' alt='' border='0' style='vertical-align: middle' /> %MAKETEXT{"Change"}%&nbsp;</a>
 </div>
 <div id="profilePicture">
-%CALCULATE{$SET(image, %FORMFIELD{ "Image" topic="%INCLUDINGTOPIC%" }%)}%<nop>
+%CALCULATE{$SET(image, %FORMFIELD{ "Image" topic="%INCLUDINGTOPIC%" encode="safe" }%)}%<nop>
 %IF{
  "'%INCLUDINGTOPIC%'/attachments[name='%CALCULATE{$GET(image)}%']"
  then='<a href="%PUBURLPATH%/%WEB%/%INCLUDINGTOPIC%/%CALCULATE{$GET(image)}%" rel="nofollow"><img src="%PUBURLPA
TH%/%WEB%/%INCLUDINGTOPIC%/%CALCULATE{$GET(image)}%" width="200" border="0" alt="" /></a>'
@@ -65,10 +65,10 @@
 </div>
 <div style="margin-top: 5px; overflow: hidden; white-space: nowrap; line-height: 28px; width: 200px;">
 <noautolink>
-%ICON{mail}% %FORMFIELD{ "Email" topic="%INCLUDINGTOPIC%" }% &nbsp;
-%BR%%ICON{phone}% %FORMFIELD{ "Telephone" topic="%INCLUDINGTOPIC%" }% &nbsp;
-%BR%%ICON{mobile}% %FORMFIELD{ "Mobile" topic="%INCLUDINGTOPIC%" }% &nbsp;
-%BR%%ICON{skype}% %FORMFIELD{ "SkypeID" topic="%INCLUDINGTOPIC%" }% &nbsp;
+%ICON{mail}% %FORMFIELD{ "Email" topic="%INCLUDINGTOPIC%" encode="safe" }% &nbsp;
+%BR%%ICON{phone}% %FORMFIELD{ "Telephone" topic="%INCLUDINGTOPIC%" encode="safe" }% &nbsp;
+%BR%%ICON{mobile}% %FORMFIELD{ "Mobile" topic="%INCLUDINGTOPIC%" encode="safe" }% &nbsp;
+%BR%%ICON{skype}% %FORMFIELD{ "SkypeID" topic="%INCLUDINGTOPIC%" encode="safe" }% &nbsp;
 </noautolink>
 </div>
 </td><td valign="top">
@@ -76,7 +76,7 @@
 </td><td valign="top" colspan="3">
 <noautolink>
 <h1>
-%FORMFIELD{ "FirstName" topic="%INCLUDINGTOPIC%" }% %FORMFIELD{ "LastName" topic="%INCLUDINGTOPIC%" }% <span sty
le="font-size: 60%"> %FORMFIELD{ "StatusUpdate" topic="%INCLUDINGTOPIC%" }%</span>
+%FORMFIELD{ "FirstName" topic="%INCLUDINGTOPIC%" encode="safe" }% %FORMFIELD{ "LastName" topic="%INCLUDINGTOPIC%
" encode="safe" }% <span style="font-size: 60%"> %FORMFIELD{ "StatusUpdate" topic="%INCLUDINGTOPIC%" encode="safe
" }%</span>
 </h1>
 </noautolink>
 </td></tr><tr><td></td><td valign="top" class="profileBox">
@@ -88,20 +88,20 @@
 </div>
 <div style="clear: right;"></div>
 <div id="viewInfo">
-|  %MAKETEXT{"Title"}%: | <noautolink> %FORMFIELD{ "Titles" topic="%INCLUDINGTOPIC%" }% </noautolink> |
-|  %MAKETEXT{"Department"}%: | <noautolink> %FORMFIELD{ "Department" topic="%INCLUDINGTOPIC%" }% </noautolink> |
-|  %MAKETEXT{"Organization"}%: | <noautolink> %FORMFIELD{ "Organization" topic="%INCLUDINGTOPIC%" }% </noautolin
k> |
-|  %MAKETEXT{"URL"}%: | %FORMFIELD{ "URL" topic="%INCLUDINGTOPIC%" }% |
-|  %MAKETEXT{"Location"}%: | <noautolink> %FORMFIELD{ "Location" topic="%INCLUDINGTOPIC%" }% </noautolink> |
-|  %MAKETEXT{"Region"}%: | <noautolink> %FORMFIELD{ "Region" topic="%INCLUDINGTOPIC%" }% </noautolink> |
-|  %MAKETEXT{"Country"}%: | <noautolink> %FORMFIELD{ "Country" topic="%INCLUDINGTOPIC%" }% </noautolink> |
+|  %MAKETEXT{"Title"}%: | <noautolink> %FORMFIELD{ "Titles" topic="%INCLUDINGTOPIC%" encode="safe" }% </noautoli
nk> |
+|  %MAKETEXT{"Department"}%: | <noautolink> %FORMFIELD{ "Department" topic="%INCLUDINGTOPIC%" encode="safe" }% <
/noautolink> |
+|  %MAKETEXT{"Organization"}%: | <noautolink> %FORMFIELD{ "Organization" topic="%INCLUDINGTOPIC%" encode="safe" 
}% </noautolink> |
+|  %MAKETEXT{"URL"}%: | %FORMFIELD{ "URL" topic="%INCLUDINGTOPIC%" encode="safe" }% |
+|  %MAKETEXT{"Location"}%: | <noautolink> %FORMFIELD{ "Location" topic="%INCLUDINGTOPIC%" encode="safe" }% </noa
utolink> |
+|  %MAKETEXT{"Region"}%: | <noautolink> %FORMFIELD{ "Region" topic="%INCLUDINGTOPIC%" encode="safe" }% </noautol
ink> |
+|  %MAKETEXT{"Country"}%: | <noautolink> %FORMFIELD{ "Country" topic="%INCLUDINGTOPIC%" encode="safe" }% </noaut
olink> |
 </div>
 </td><td valign="top">
 <img src="%PUBURLPATH%/%WEB%/UserProfileHeader/spacer.gif" width="20" height="1" />
 </td><td valign="top" class="profileBox" style="min-width: 200px; width: 300px;">
 %CALCULATE{$SET(showwatchlist, %IF{ "context WatchlistPluginEnabled AND NOT '%TAGCLOUDPROFILE%'='on'" then="1" e
lse="0" }%)}%<nop>
 <div style="display: %CALCULATE{$IF($GET(showwatchlist), block, none)}%;">
-<b>%MAKETEXT{"Watchlist Changes of [_1]:" args="<nop>%FORMFIELD{ "FirstName" topic="%INCLUDINGTOPIC%" }%"}%</b>
+<b>%MAKETEXT{"Watchlist Changes of [_1]:" args="<nop>%FORMFIELD{ "FirstName" topic="%INCLUDINGTOPIC%" encode="sa
fe" }%"}%</b>
 <div style="height:18em; min-width: 180px; overflow:hidden; overflow-y:auto; margin-right: -8px;">
 %WATCHLIST{
  "showchanges"
@@ -119,7 +119,7 @@
 </div>
 </div>
 <div style="display: %CALCULATE{$IF($GET(showwatchlist), none, block)}%;">
-<b>%MAKETEXT{"Tag Cloud of [_1]:" args="<nop>%FORMFIELD{ "FirstName" topic="%INCLUDINGTOPIC%" }%"}%</b>
+<b>%MAKETEXT{"Tag Cloud of [_1]:" args="<nop>%FORMFIELD{ "FirstName" topic="%INCLUDINGTOPIC%" encode="safe" }%"}
%</b>
 <div style="height:18em; min-width: 180px; overflow:hidden; overflow-y:auto;">
 %TAGME{ tpaction="%CALCULATE{$IF($GET(showwatchlist), DISABLE, showalltags)}%" format="<a href=\"%SCRIPTURL{view
}%/%SYSTEMWEB%/TagMeSearch?tag=$tag;by=%INCLUDINGTOPIC%\" style=\"font-size:$size%\">$tag</a>" separator="&nbsp; 
"  minsize="80" maxsize="120" by="%INCLUDINGTOPIC%" }%
 </div>
@@ -131,8 +131,8 @@
 <form action="%SCRIPTURL{save}%/%INCLUDINGWEB%/%INCLUDINGTOPIC%" method="post">
 <table border="0" cellspacing="0" cellpadding="0"><tr><td valign="top" class="profileBox" style="width: 200px;" 
rowspan="2">
 <img src="%IF{
- "'%INCLUDINGTOPIC%'/attachments[name='%FORMFIELD{ "Image" topic="%INCLUDINGTOPIC%" }%']"
- then='%PUBURLPATH%/%WEB%/%INCLUDINGTOPIC%/$percntFORMFIELD{ "Image" topic="%INCLUDINGTOPIC%" }$percnt'
+ "'%INCLUDINGTOPIC%'/attachments[name='%FORMFIELD{ "Image" topic="%INCLUDINGTOPIC%" encode="safe" }%']"
+ then='%PUBURLPATH%/%WEB%/%INCLUDINGTOPIC%/$percntFORMFIELD{ "Image" topic="%INCLUDINGTOPIC%" encode="safe" }$pe
rcnt'
  else='%PUBURLPATH%/%WEB%/UserProfileHeader/default-user-profile.jpg'
 }%" width="200" alt="" />
 <div style="margin-top: 5px; overflow: hidden; white-space: nowrap; line-height: 28px; width: 200px;">
@@ -150,7 +150,7 @@
 <table border="0" cellspacing="0" cellpadding="0"><tr><td valign="top" style="white-space: nowrap">
 <noautolink>
 <h1>
-%FORMFIELD{ "FirstName" topic="%INCLUDINGTOPIC%" }% %FORMFIELD{ "LastName" topic="%INCLUDINGTOPIC%" }%
+%FORMFIELD{ "FirstName" topic="%INCLUDINGTOPIC%" encode="safe" }% %FORMFIELD{ "LastName" topic="%INCLUDINGTOPIC%
" encode="safe" }%
 </h1>
 </noautolink>
 </td><td>&nbsp;</td><td valign="top">
@@ -173,13 +173,13 @@
 <img src="%PUBURLPATH%/%WEB%/UserProfileHeader/spacer.gif" width="20" height="1" />
 </td><td valign="top" class="profileBox" style="min-width: 200px;">
 <div style="display: %CALCULATE{$IF($GET(showwatchlist), block, none)}%;">
-<b>%MAKETEXT{"Watchlist Changes of [_1]:" args="<nop>%FORMFIELD{ "FirstName" topic="%INCLUDINGTOPIC%" }%"}%</b>
+<b>%MAKETEXT{"Watchlist Changes of [_1]:" args="<nop>%FORMFIELD{ "FirstName" topic="%INCLUDINGTOPIC%" encode="sa
fe" }%"}%</b>
 %BR%%BR%
 <strong><em>%MAKETEXT{"Note:"}%</em></strong>
 %MAKETEXT{"Watch topics to see watchlist changes."}%
 </div>
 <div style="display: %CALCULATE{$IF($GET(showwatchlist), none, block)}%;">
-<b>%MAKETEXT{"Tag Cloud of [_1]:" args="<nop>%FORMFIELD{ "FirstName" topic="%INCLUDINGTOPIC%" }%"}%</b>
+<b>%MAKETEXT{"Tag Cloud of [_1]:" args="<nop>%FORMFIELD{ "FirstName" topic="%INCLUDINGTOPIC%" encode="safe" }%"}
%</b>
 %BR%%BR%
 <strong><em>%MAKETEXT{"Note:"}%</em></strong>
 %MAKETEXT{"Tag topics to modify your tag cloud."}%
@@ -198,7 +198,7 @@
 
    * Set ALLOWTOPICCHANGE = TWikiAdminGroup
 
-__Related topics:__ [[%WIKIUSERSTOPIC%]], [[%SYSTEMWEB%.UserForm][UserForm]], [[%SYSTEMWEB%.NewUserTemplate][New
UserTemplate]], [[%SYSTEMWEB%.TWikiRegistration][TWikiRegistration]], [[%SYSTEMWEB%.TWikiForms][TWikiForms]]
+__Related topics:__ [[UserList]], [[%WIKIUSERSTOPIC%]], ChangeProfilePicture, %IF{"istopic 'UserForm'" then="[[U
serForm]],"}% %IF{"istopic 'NewUserTemplate'" then="[[NewUserTemplate]],"}% [[%SYSTEMWEB%.UserForm]], [[%SYSTEMWE
B%.NewUserTemplate]], [[%SYSTEMWEB%.TWikiRegistration]], [[%SYSTEMWEB%.TWikiForms]]
 
 %META:FILEATTACHMENT{name="gradient-title.png" attachment="gradient-title.png" attr="h" comment="" date="1307256
050" path="gradient-title.png" size="207" user="TWikiContributor" version="1"}%
 %META:FILEATTACHMENT{name="spacer.gif" attachment="spacer.gif" attr="h" comment="" date="1307260346" path="space
r.gif" size="43" user="TWikiContributor" version="1"}%

-- TWiki:Main/PeterThoeny - 2018-01-01