diff --git a/lib/Ebook.php b/lib/Ebook.php index ca191246..a287069c 100644 --- a/lib/Ebook.php +++ b/lib/Ebook.php @@ -489,7 +489,7 @@ class Ebook{ $this->AuthorsHtml = $this->GenerateContributorList($this->Authors, true); // Now the complete title with credits. - $this->TitleWithCreditsHtml = Formatter::ToPlainText($this->Title) . ', by ' . str_replace('&', '&', $this->AuthorsHtml . $titleContributors); + $this->TitleWithCreditsHtml = Formatter::EscapeHtml($this->Title) . ', by ' . str_replace('&', '&', $this->AuthorsHtml . $titleContributors); } @@ -671,30 +671,30 @@ class Ebook{ if($contributor->WikipediaUrl){ if($includeRdfa){ - $string .= '' . Formatter::ToPlainText($contributor->Name) . ''; + $string .= '' . Formatter::EscapeHtml($contributor->Name) . ''; if($contributor->NacoafUrl){ - $string .= ''; + $string .= ''; } } else{ - $string .= '' . Formatter::ToPlainText($contributor->Name); + $string .= '' . Formatter::EscapeHtml($contributor->Name); } $string .= ''; } else{ if($includeRdfa){ - $string .= '' . Formatter::ToPlainText($contributor->Name) . ''; + $string .= '' . Formatter::EscapeHtml($contributor->Name) . ''; if($contributor->NacoafUrl){ - $string .= ''; + $string .= ''; } $string .= ''; } else{ - $string .= Formatter::ToPlainText($contributor->Name); + $string .= Formatter::EscapeHtml($contributor->Name); } } @@ -736,14 +736,14 @@ class Ebook{ $string .= '
' . "\n"; } - $string .= '' . "\n"; + $string .= '' . "\n"; if($contributor->WikipediaUrl){ - $string .= '' . "\n"; + $string .= '' . "\n"; } if($contributor->NacoafUrl){ - $string .= '' . "\n"; + $string .= '' . "\n"; } $string .= '
'; diff --git a/lib/Formatter.php b/lib/Formatter.php index 509fdea2..c00f1acf 100644 --- a/lib/Formatter.php +++ b/lib/Formatter.php @@ -32,11 +32,11 @@ class Formatter{ return $text; } - public static function ToPlainText(?string $text): string{ + public static function EscapeHtml(?string $text): string{ return htmlspecialchars(trim($text ?? ''), ENT_QUOTES, 'utf-8'); } - public static function ToPlainXmlText(?string $text): string{ + public static function EscapeXml(?string $text): string{ return htmlspecialchars(trim($text ?? ''), ENT_QUOTES|ENT_XML1, 'utf-8'); } diff --git a/templates/ArtworkForm.php b/templates/ArtworkForm.php index fa41e691..a70f1911 100644 --- a/templates/ArtworkForm.php +++ b/templates/ArtworkForm.php @@ -20,9 +20,9 @@ $now = new DateTime('now', new DateTimeZone('America/Juneau')); // Latest contin For existing artists, leave the year of death blank. - + AlternateSpellings as $alternateSpelling){ ?> - + @@ -32,7 +32,7 @@ $now = new DateTime('now', new DateTimeZone('America/Juneau')); // Latest contin list="artist-names" required="required" autocomplete="off" - value="Artist->Name) ?>" + value="Artist->Name) ?>" /> @@ -53,7 +53,7 @@ $now = new DateTime('now', new DateTimeZone('America/Juneau')); // Latest contin
@@ -129,7 +129,7 @@ $now = new DateTime('now', new DateTimeZone('America/Juneau')); // Latest contin name="artwork-publication-year" inputmode="numeric" pattern="[0-9]+" - value="PublicationYear) ?>" + value="PublicationYear) ?>" /> @@ -168,7 +168,7 @@ $now = new DateTime('now', new DateTimeZone('America/Juneau')); // Latest contin @@ -177,7 +177,7 @@ $now = new DateTime('now', new DateTimeZone('America/Juneau')); // Latest contin CanStatusBeChangedBy($GLOBALS['User'] ?? null) || $artwork->CanEbookWwwFilesysemPathBeChangedBy($GLOBALS['User'] ?? null)){ ?> @@ -199,7 +199,7 @@ $now = new DateTime('now', new DateTimeZone('America/Juneau')); // Latest contin diff --git a/templates/ArtworkStatus.php b/templates/ArtworkStatus.php index 4b59ab0c..aefe22dc 100644 --- a/templates/ArtworkStatus.php +++ b/templates/ArtworkStatus.php @@ -5,5 +5,5 @@ $artwork = $artwork ?? null; Status == ArtworkStatus::Approved){ ?>Approved Status == ArtworkStatus::Declined){ ?>Declined Status == ArtworkStatus::Unverified){ ?>Unverified -EbookWwwFilesystemPath !== null){ ?> — in useEbookWwwFilesystemPath !== null){ ?> by Ebook !== null && $artwork->Ebook->Url !== null){ ?>Ebook->Title) ?>EbookWwwFilesystemPath) ?> (unreleased) +EbookWwwFilesystemPath !== null){ ?> — in useEbookWwwFilesystemPath !== null){ ?> by Ebook !== null && $artwork->Ebook->Url !== null){ ?>Ebook->Title) ?>EbookWwwFilesystemPath) ?> (unreleased) diff --git a/templates/AtomFeed.php b/templates/AtomFeed.php index ad5aed53..5d74252e 100644 --- a/templates/AtomFeed.php +++ b/templates/AtomFeed.php @@ -7,10 +7,10 @@ $subtitle = $subtitle ?? null; print("\n"); ?> - - - <?= Formatter::ToPlainXmlText($title) ?> - + + + <?= Formatter::EscapeXml($title) ?> + /images/logo.png format('Y-m-d\TH:i:s\Z') ?> diff --git a/templates/AtomFeedEntry.php b/templates/AtomFeedEntry.php index 969dfdbf..5c19b0bf 100644 --- a/templates/AtomFeedEntry.php +++ b/templates/AtomFeedEntry.php @@ -1,22 +1,22 @@ Url ?> - <?= Formatter::ToPlainXmlText($entry->Title) ?> + <?= Formatter::EscapeXml($entry->Title) ?> Authors as $author){ ?> - Name) ?> - AuthorsUrl) ?> + Name) ?> + AuthorsUrl) ?> Created->format('Y-m-d\TH:i:s\Z') ?> Updated->format('Y-m-d\TH:i:s\Z') ?> Public domain in the United States. Users located outside of the United States must check their local laws before using this ebook. Original content released to the public domain via the Creative Commons CC0 1.0 Universal Public Domain Dedication. - Description) ?> - LongDescription) ?> + Description) ?> + LongDescription) ?> LocTags as $subject){ ?> - + Tags as $subject){ ?> - + diff --git a/templates/BulkDownloadTable.php b/templates/BulkDownloadTable.php index 5f172397..1d0aee64 100644 --- a/templates/BulkDownloadTable.php +++ b/templates/BulkDownloadTable.php @@ -11,13 +11,13 @@ - Label) ?> - EbookCount)) ?> - UpdatedString) ?> + Label) ?> + EbookCount)) ?> + UpdatedString) ?> ZipFiles as $item){ ?> Type ?> - (Size) ?>) + (Size) ?>) diff --git a/templates/EbookGrid.php b/templates/EbookGrid.php index 4fb22e8e..cbe4a0c3 100644 --- a/templates/EbookGrid.php +++ b/templates/EbookGrid.php @@ -9,7 +9,7 @@ $ebooks = $ebooks ?? []; ?>
    typeof="schema:BookSeries" about="Url ?>"> - +
  1. resource="Url ?>" property="schema:hasPart"GetCollectionPosition($collection) !== null){ ?> value="GetCollectionPosition($collection) ?>" about="Url ?>"> @@ -21,19 +21,19 @@ $ebooks = $ebooks ?? []; CoverImage2xAvifUrl !== null){ ?> - The cover for the Standard Ebooks edition of <?= Formatter::ToPlainText(strip_tags($ebook->TitleWithCreditsHtml)) ?> + The cover for the Standard Ebooks edition of <?= Formatter::EscapeHtml(strip_tags($ebook->TitleWithCreditsHtml)) ?> -

    Title) ?>

    +

    Title) ?>

    Authors as $author){ ?> -

    Name != 'Anonymous'){ ?>Name) ?>

    +

    Name != 'Anonymous'){ ?>Name) ?>

    Authors as $author){ ?> -

    Name != 'Anonymous'){ ?>Name) ?>

    +

    Name != 'Anonymous'){ ?>Name) ?>

    @@ -43,7 +43,7 @@ $ebooks = $ebooks ?? [];

    WordCount) ?> words • ReadingEase ?> reading ease

    - +
    2. diff --git a/templates/EmailAdminNewPatron.php b/templates/EmailAdminNewPatron.php index 8f534d2d..b760e61d 100644 --- a/templates/EmailAdminNewPatron.php +++ b/templates/EmailAdminNewPatron.php @@ -17,7 +17,7 @@ Name: - User->Name === null){ ?>Anonymous User->Name) ?>IsAnonymous){ ?> (Anonymous) + User->Name === null){ ?>Anonymous User->Name) ?>IsAnonymous){ ?> (Anonymous) Donation type: @@ -25,15 +25,15 @@ Donation amount: - Amount, 2)) ?> + Amount, 2)) ?> Donation fee: - Fee, 2)) ?> + Fee, 2)) ?> Transaction ID: - TransactionId) ?> + TransactionId) ?> diff --git a/templates/EmailAdminNewPatronText.php b/templates/EmailAdminNewPatronText.php index 5c73a45e..a1dfbb9f 100644 --- a/templates/EmailAdminNewPatronText.php +++ b/templates/EmailAdminNewPatronText.php @@ -1,9 +1,9 @@ -Name: User->Name === null){ ?>Anonymous User->Name) ?>IsAnonymous){ ?> (Anonymous) +Name: User->Name === null){ ?>Anonymous User->Name) ?>IsAnonymous){ ?> (Anonymous) Donation type: IsRecurring){ ?>RecurringOne-time -Donation amount: Amount, 2)) ?> +Donation amount: Amount, 2)) ?> -Donation fee: Fee, 2)) ?> +Donation fee: Fee, 2)) ?> -Transaction ID: TransactionId) ?> +Transaction ID: TransactionId) ?> diff --git a/templates/EmailHeader.php b/templates/EmailHeader.php index c274a8f1..9c1936b3 100644 --- a/templates/EmailHeader.php +++ b/templates/EmailHeader.php @@ -191,4 +191,4 @@ $letterhead = $letterhead ?? false;
    -

    ‌ 

    +

    ‌ 

    diff --git a/templates/Error.php b/templates/Error.php index 97e52ee0..d42376bf 100644 --- a/templates/Error.php +++ b/templates/Error.php @@ -16,7 +16,7 @@ else{
    • -

      getMessage(); if($message == ''){ $message = 'An error occurred.'; } ?>CAPTCHA', Formatter::ToPlainText($message)) ?>

      +

      getMessage(); if($message == ''){ $message = 'An error occurred.'; } ?>CAPTCHA', Formatter::EscapeHtml($message)) ?>

    diff --git a/templates/Header.php b/templates/Header.php index 7a556e06..ef5f2d33 100644 --- a/templates/Header.php +++ b/templates/Header.php @@ -29,8 +29,8 @@ if(!$isXslt){ - <? if($title != ''){ ?><?= Formatter::ToPlainText($title) ?> - <? } ?>Standard Ebooks: Free and liberated ebooks, carefully produced for the true book lover. - + <? if($title != ''){ ?><?= Formatter::EscapeHtml($title) ?> - <? } ?>Standard Ebooks: Free and liberated ebooks, carefully produced for the true book lover. + @@ -65,15 +65,15 @@ if(!$isXslt){ - - - + + + - + diff --git a/templates/OpdsAcquisitionEntry.php b/templates/OpdsAcquisitionEntry.php index ea840318..ede690f4 100644 --- a/templates/OpdsAcquisitionEntry.php +++ b/templates/OpdsAcquisitionEntry.php @@ -1,29 +1,29 @@ Url ?> - Identifier) ?> - <?= Formatter::ToPlainXmlText($entry->Title) ?> + Identifier) ?> + <?= Formatter::EscapeXml($entry->Title) ?> Authors as $author){ ?> - Name) ?> - AuthorsUrl) ?> - FullName !== null){ ?>FullName) ?> - WikipediaUrl !== null){ ?>WikipediaUrl) ?> - NacoafUrl !== null){ ?>NacoafUrl) ?> + Name) ?> + AuthorsUrl) ?> + FullName !== null){ ?>FullName) ?> + WikipediaUrl !== null){ ?>WikipediaUrl) ?> + NacoafUrl !== null){ ?>NacoafUrl) ?> Created->format('Y-m-d\TH:i:s\Z') ?> Created->format('Y-m-d\TH:i:s\Z') ?> Updated->format('Y-m-d\TH:i:s\Z') ?> - Language) ?> + Language) ?> Standard Ebooks Public domain in the United States. Users located outside of the United States must check their local laws before using this ebook. Original content released to the public domain via the Creative Commons CC0 1.0 Universal Public Domain Dedication. - Description) ?> - LongDescription) ?> + Description) ?> + LongDescription) ?> LocTags as $subject){ ?> - + Tags as $subject){ ?> - + diff --git a/templates/OpdsAcquisitionFeed.php b/templates/OpdsAcquisitionFeed.php index b51d8a3b..c2225c6a 100644 --- a/templates/OpdsAcquisitionFeed.php +++ b/templates/OpdsAcquisitionFeed.php @@ -17,14 +17,14 @@ $subtitle = $subtitle ?? null; print("\n"); ?> xmlns:fh="http://purl.org/syndication/history/1.0"> - - + + - + - <?= Formatter::ToPlainXmlText($title) ?> - + <?= Formatter::EscapeXml($title) ?> + /images/logo.png format('Y-m-d\TH:i:s\Z') ?> diff --git a/templates/OpdsNavigationFeed.php b/templates/OpdsNavigationFeed.php index 9ac7fa37..0a4f4aa0 100644 --- a/templates/OpdsNavigationFeed.php +++ b/templates/OpdsNavigationFeed.php @@ -8,14 +8,14 @@ $subtitle = $subtitle ?? null; print("\n"); ?> - - + + - - <?= Formatter::ToPlainXmlText($title) ?> - + + <?= Formatter::EscapeXml($title) ?> + /images/logo.png format('Y-m-d\TH:i:s\Z') ?> @@ -24,11 +24,11 @@ print("\n"); - <?= Formatter::ToPlainXmlText($entry->Title) ?> - + <?= Formatter::EscapeXml($entry->Title) ?> + Updated !== null){ ?>Updated->format('Y-m-d\TH:i:s\Z') ?> - Id) ?> - Description) ?> + Id) ?> + Description) ?> diff --git a/templates/RssEntry.php b/templates/RssEntry.php index d47f9a6f..f6342973 100644 --- a/templates/RssEntry.php +++ b/templates/RssEntry.php @@ -1,14 +1,14 @@ - <?= Formatter::ToPlainXmlText($entry->Title) ?>, by <?= Formatter::ToPlainXmlText(strip_tags($entry->AuthorsHtml)) ?> - Url) ?> - Description) ?> + <?= Formatter::EscapeXml($entry->Title) ?>, by <?= Formatter::EscapeXml(strip_tags($entry->AuthorsHtml)) ?> + Url) ?> + Description) ?> Created->format('r') ?> - Identifier)) ?> + Identifier)) ?> Tags as $tag){ ?> - Name) ?> + Name) ?> EpubUrl !== null){ ?> - is allowed */ ?> + is allowed */ ?> diff --git a/templates/RssFeed.php b/templates/RssFeed.php index b17d3e13..d4021aba 100644 --- a/templates/RssFeed.php +++ b/templates/RssFeed.php @@ -7,18 +7,18 @@ use Safe\DateTime; print("\n"); ?> - <?= Formatter::ToPlainXmlText($title) ?> + <?= Formatter::EscapeXml($title) ?> - + en-US https://creativecommons.org/publicdomain/zero/1.0/ http://blogs.law.harvard.edu/tech/rss - +