From 99493731aef1fea9cab47e7f2694dcb0e0b019f3 Mon Sep 17 00:00:00 2001 From: Brady Miller Date: Wed, 28 Mar 2018 21:03:16 -0700 Subject: [PATCH] security fixes (#1531) --- gacl/admin/about.php | 2 +- gacl/admin/templates/phpgacl/about.tpl | 6 +++--- gacl/admin/templates/phpgacl/footer.tpl | 6 +++--- gacl/admin/templates/phpgacl/header.tpl | 2 +- gacl/admin/templates/phpgacl/navigation.tpl | 2 +- 5 files changed, 9 insertions(+), 9 deletions(-) diff --git a/gacl/admin/about.php b/gacl/admin/about.php index 7ca1a22bf..c8cb021fa 100644 --- a/gacl/admin/about.php +++ b/gacl/admin/about.php @@ -84,7 +84,7 @@ switch ($_POST['action']) { $system_info = get_system_info(); //Read credits. - $smarty->assign("credits", htmlentities( implode('',file('../CREDITS')) )); + $smarty->assign("credits", implode('',file('../CREDITS')) ); $smarty->assign("system_info", $system_info); $smarty->assign("system_info_md5", md5($system_info) ); diff --git a/gacl/admin/templates/phpgacl/about.tpl b/gacl/admin/templates/phpgacl/about.tpl index 9e321828b..ccb1ab6ad 100644 --- a/gacl/admin/templates/phpgacl/about.tpl +++ b/gacl/admin/templates/phpgacl/about.tpl @@ -59,9 +59,9 @@ All information will be kept private, will not be sold, and will only be used for informational purposes regarding phpGACL.

- +
- +
@@ -75,7 +75,7 @@ 
-{$credits}
+{$credits|escape:'html'}
diff --git a/gacl/admin/templates/phpgacl/footer.tpl b/gacl/admin/templates/phpgacl/footer.tpl index 0068056ed..f75c04267 100644 --- a/gacl/admin/templates/phpgacl/footer.tpl +++ b/gacl/admin/templates/phpgacl/footer.tpl @@ -1,11 +1,11 @@ - +
- phpGACL v{$phpgacl_version} (Schema v{$phpgacl_schema_version}) - Generic Access Control Lists + phpGACL v{$phpgacl_version|escape:'html'} (Schema v{$phpgacl_schema_version|escape:'html'}) - Generic Access Control Lists
Copyright © 2005 Mike Benoit
- + diff --git a/gacl/admin/templates/phpgacl/header.tpl b/gacl/admin/templates/phpgacl/header.tpl index 65d51f636..2613f5952 100644 --- a/gacl/admin/templates/phpgacl/header.tpl +++ b/gacl/admin/templates/phpgacl/header.tpl @@ -2,5 +2,5 @@ - phpGACL - {$page_title} + phpGACL - {$page_title|escape:'html'} diff --git a/gacl/admin/templates/phpgacl/navigation.tpl b/gacl/admin/templates/phpgacl/navigation.tpl index c494ec8e6..905e83856 100644 --- a/gacl/admin/templates/phpgacl/navigation.tpl +++ b/gacl/admin/templates/phpgacl/navigation.tpl @@ -1,6 +1,6 @@

phpGACL

-

{$page_title}

+

{$page_title|escape:'html'}

(Back to OpenEMR's ACL menu)

{if $hidemenu neq TRUE}