Skip to content
This repository was archived by the owner on Jun 25, 2024. It is now read-only.

Commit e56c2a9

Browse files
longrunningprocesslongrunningprocess
authored
Merge branch 'develop' into feature/what-about-the-phone
2 parents 879a119 + 913be71 commit e56c2a9

File tree

6 files changed

+36
-31
lines changed

6 files changed

+36
-31
lines changed

‎docker-compose.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ services:
1919
ADMIN_EMAIL: "[email protected]"
2020
SECRET_SALT: "FcJwl0zCDc4nuzOuQL9/7WPIj3hdfusGm2ny0dcRQm0="
2121
IDP_NAME: "The Hub"
22+
ANALYTICS_ID: "UA-XXXX-Y"
2223
idp1:
2324
image: silintl/ssp-base:develop
2425
volumes:

‎themes/material/common-announcement.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
<?php
2-
$announcement = $this->data['announcement'] ?? null;
2+
$announcement = htmlentities($this->data['announcement'] ?? null);
33

44
if (! empty($announcement)) {
55
?>

‎themes/material/common-head-elements.php‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,7 @@
44
<meta name="viewport" content="width=device-width, initial-scale=1.0">
55

66
<?php
7-
$trackingId = $this->configuration->getValue('analytics.trackingId');
8-
7+
$trackingId = htmlentities($this->configuration->getValue('analytics.trackingId'));
98
if (! empty($trackingId)) {
109
?>
1110
<script>
@@ -28,7 +27,7 @@
2827

2928

3029
<?php
31-
$colors = $this->configuration->getValue('theme.color-scheme', 'indigo-purple');
30+
$colors = htmlentities($this->configuration->getValue('theme.color-scheme', 'indigo-purple'));
3231
?>
3332
<link rel="stylesheet" href="/module.php/material/material.<?= $colors ?>.1.2.1.min.css">
3433
<link rel="stylesheet" href="/module.php/material/styles.2.2.0.css">

‎themes/material/core/loginuserpass.php‎

Lines changed: 22 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,12 @@
11
<!DOCTYPE html>
2-
<?php
3-
$siteKey = $this->data['recaptcha.siteKey'] ?? null;
4-
$username = $this->data['username'] ?? null;
5-
$forgotPasswordUrl = $this->data['forgotPasswordUrl'] ?? null;
6-
$csrfToken = $this->data['csrfToken'] ?? null;
7-
$idpName = $this->configuration->getValue('idp_name', '—');
8-
9-
$errorCode = $this->data['errorcode'] ?? null;
10-
$errorMessageKey = $this->data['errorparams'][1] ?? '{material:login:error_wronguserpass}';
11-
$errorMessageTokens = $this->data['errorparams'][2] ?? [];
12-
?>
132
<html>
143
<head>
154
<title><?= $this->t('{material:login:title}') ?></title>
165

176
<?php include __DIR__ . '/../common-head-elements.php' ?>
187

198
<?php
9+
$siteKey = htmlentities($this->data['recaptcha.siteKey'] ?? null);
2010
if (! empty($siteKey)) {
2111
?>
2212
<script src='https://www.google.com/recaptcha/api.js?onload=onRecaptchaLoad&render=explicit'
@@ -31,7 +21,7 @@ function onRecaptchaLoad() {
3121
var loginButton = document.querySelector('button');
3222

3323
grecaptcha.render(loginButton, {
34-
sitekey: '<?= htmlentities($siteKey) ?>',
24+
sitekey: '<?= $siteKey ?>',
3525
callback: submitForm
3626
});
3727
}
@@ -47,12 +37,19 @@ function onRecaptchaLoad() {
4737
<main class="mdl-layout__content" layout-children="column" child-spacing="center">
4838
<?php include __DIR__ . '/../common-announcement.php' ?>
4939

40+
5041
<form method="POST" action="<?= htmlentities($_SERVER['PHP_SELF']) ?>">
5142
<input type="hidden" name="AuthState"
52-
value="<?= htmlspecialchars($this->data['stateparams']['AuthState']) ?>" />
53-
<input type="hidden" name="csrf-token" value="<?= htmlentities($csrfToken); ?>" />
43+
value="<?= htmlentities($this->data['stateparams']['AuthState'] ?? null) ?>" />
44+
<?php
45+
$csrfToken = htmlentities($this->data['csrfToken'] ?? null);
46+
?>
47+
<input type="hidden" name="csrf-token" value="<?= $csrfToken ?>" />
5448

5549
<div class="mdl-card mdl-shadow--8dp fill-phone-viewport">
50+
<?php
51+
$idpName = htmlentities($this->configuration->getValue('idp_name', '—'));
52+
?>
5653
<div class="mdl-card__media white-bg margin" layout-children="column">
5754
<img src="/logo.png"
5855
alt="<?= $this->t('{material:login:logo}', ['{idpName}' => $idpName]) ?>">
@@ -69,8 +66,11 @@ function onRecaptchaLoad() {
6966
<label for="username" class="mdl-textfield__label">
7067
<?= $this->t('{material:login:label_username}') ?>
7168
</label>
69+
<?php
70+
$username = htmlentities($this->data['username'] ?? null);
71+
?>
7272
<input type="text" name="username" class="mdl-textfield__input"
73-
value="<?= htmlspecialchars($username) ?>"
73+
value="<?= $username ?>"
7474
<?= empty($username) ? 'autofocus' : '' ?> id="username"/>
7575
</div>
7676

@@ -84,8 +84,12 @@ function onRecaptchaLoad() {
8484
</div>
8585

8686
<?php
87+
$errorCode = htmlentities($this->data['errorcode']);
8788
if ($errorCode == 'WRONGUSERPASS') {
88-
$message = $this->t($errorMessageKey, $errorMessageTokens);
89+
$errorMessageKey = $this->data['errorparams'][1] ?? '{material:login:error_wronguserpass}';
90+
$errorMessageTokens = $this->data['errorparams'][2] ?? null;
91+
92+
$message = htmlentities($this->t($errorMessageKey, $errorMessageTokens));
8993
?>
9094
<p class="mdl-color-text--red error">
9195
<i class="material-icons">error</i>
@@ -104,9 +108,10 @@ function onRecaptchaLoad() {
104108

105109
<div class="mdl-card__actions" layout-children="row">
106110
<?php
111+
$forgotPasswordUrl = htmlentities($this->data['forgotPasswordUrl'] ?? null);
107112
if (! empty($forgotPasswordUrl)) {
108113
?>
109-
<a href="<?= htmlentities($forgotPasswordUrl) ?>" target="_blank"
114+
<a href="<?= $forgotPasswordUrl ?>" target="_blank"
110115
class="mdl-button mdl-button--colored mdl-typography--caption">
111116
<?= $this->t('{material:login:forgot}') ?>
112117
</a>

‎themes/material/default/error.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,14 +21,14 @@
2121
</p>
2222

2323
<?php
24-
if ($this->data['showerrors']) {
24+
if ($this->data['showerrors'] ?? false) {
2525
?>
2626
<p class="mdl-typography--body-2">
27-
<?= htmlspecialchars($this->data['error']['exceptionMsg']) ?>
27+
<?= htmlentities($this->data['error']['exceptionMsg'] ?? null) ?>
2828
</p>
2929

3030
<pre class="mdl-typography--caption">
31-
<?= htmlspecialchars($this->data['error']['exceptionTrace']) ?>
31+
<?= htmlentities($this->data['error']['exceptionTrace'] ?? null) ?>
3232
</pre>
3333
<?php
3434
}

‎themes/material/default/selectidp-links.php‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -40,11 +40,11 @@ function clickedAnyway(idpName) {
4040
<form action="<?= htmlentities($_SERVER['PHP_SELF']) ?>"
4141
layout-children="row" child-spacing="space-around">
4242
<input type="hidden" name="entityID"
43-
value="<?= htmlspecialchars($this->data['entityID']) ?>" />
43+
value="<?= htmlentities($this->data['entityID'] ?? null) ?>" />
4444
<input type="hidden" name="return"
45-
value="<?= htmlspecialchars($this->data['return']) ?>" />
45+
value="<?= htmlentities($this->data['return'] ?? null) ?>" />
4646
<input type="hidden" name="returnIDParam"
47-
value="<?= htmlspecialchars($this->data['returnIDParam']) ?>" />
47+
value="<?= htmlentities($this->data['returnIDParam'] ?? null) ?>" />
4848

4949
<?php
5050
// in order to bypass some built-in simplesaml behavior, an extra idp
@@ -59,8 +59,8 @@ function clickedAnyway(idpName) {
5959
}
6060

6161
foreach ($enabledIdps as $idp) {
62-
$name = htmlspecialchars($this->t($idp['name']));
63-
$idpId = htmlspecialchars($idp['entityid']);
62+
$name = htmlentities($this->t($idp['name'] ?? null));
63+
$idpId = htmlentities($idp['entityid'] ?? null);
6464
$hoverText = $this->t('{material:selectidp:enabled}', ['{idpName}' => $name]);
6565
?>
6666
<div class="mdl-card mdl-shadow--8dp row-aware" title="<?= $hoverText ?>">
@@ -78,8 +78,8 @@ function clickedAnyway(idpName) {
7878

7979
<?php
8080
foreach ($disabledIdps as $idp) {
81-
$name = htmlspecialchars($this->t($idp['name']));
82-
$idpId = htmlspecialchars($idp['entityid']);
81+
$name = htmlentities($this->t($idp['name'] ?? null));
82+
$idpId = htmlentities($idp['entityid'] ?? null);
8383
$hoverText = $this->t('{material:selectidp:disabled}', ['{idpName}' => $name]);
8484
?>
8585
<div class="mdl-card mdl-shadow--2dp disabled row-aware" title="<?= $hoverText ?>"

0 commit comments

Comments
 (0)