Fix missing escaping in resource template edit

(fix #1321)
omeka · Oct 16, 2018 · 20be3fa · 20be3fa
1 parent 846c926
commit 20be3fa
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 5 deletions.
diff --git a/application/view/omeka/admin/resource-template/show-details.phtml b/application/view/omeka/admin/resource-template/show-details.phtml
@@ -9,8 +9,8 @@ $propertyAltLabel = $escape($resourceTemplateProperty->alternateLabel());
 $propertyAltComment = $escape($resourceTemplateProperty->alternateComment());
 ?>
 <div class="meta-group">
-    <h4><?php echo ($propertyAltLabel) ? $propertyAltLabel : $this->translate($property->label()); ?></h4>
-    <div class="comment"><?php echo ($propertyAltComment) ? $propertyAltComment : $this->translate($property->comment()); ?></div>
+    <h4><?php echo ($propertyAltLabel) ? $propertyAltLabel : $escape($this->translate($property->label())); ?></h4>
+    <div class="comment"><?php echo ($propertyAltComment) ? $propertyAltComment : $escape($this->translate($property->comment())); ?></div>
 </div>
 <?php endforeach; ?>
-<?php $this->trigger('view.details', array('entity' => $resource)); ?>
+<?php $this->trigger('view.details', array('entity' => $resource)); ?>
diff --git a/application/view/omeka/admin/resource-template/show-property-row.phtml b/application/view/omeka/admin/resource-template/show-property-row.phtml
@@ -7,9 +7,9 @@ $propertyId = $escape($property->id());
 <li class="property row" data-property-id="<?php echo $propertyId; ?>">
 
     <input class="property-id" type="hidden" name="<?php echo $escape($namePrefix . '[o:property][o:id]'); ?>" value="<?php echo $escape($property->id()); ?>">
-    <input class="original-label" type="hidden" name="<?php echo $escape($namePrefix . '[o:original_label]'); ?>" value="<?php echo $this->translate($property->label()); ?>">
+    <input class="original-label" type="hidden" name="<?php echo $escape($namePrefix . '[o:original_label]'); ?>" value="<?php echo $escape($this->translate($property->label())); ?>">
     <input class="alternate-label" type="hidden" name="<?php echo $escape($namePrefix . '[o:alternate_label]'); ?>" value="<?php echo $escape($propertyRow['o:alternate_label']); ?>">
-    <input class="original-comment" type="hidden" name="<?php echo $escape($namePrefix . '[o:original_comment]'); ?>" value="<?php echo $this->translate($property->comment()); ?>">
+    <input class="original-comment" type="hidden" name="<?php echo $escape($namePrefix . '[o:original_comment]'); ?>" value="<?php echo $escape($this->translate($property->comment())); ?>">
     <input class="alternate-comment" type="hidden" name="<?php echo $escape($namePrefix . '[o:alternate_comment]'); ?>" value="<?php echo $escape($propertyRow['o:alternate_comment']); ?>">
     <input class="is-required" type="hidden" name="<?php echo $escape($namePrefix . '[o:is_required]'); ?>" value="<?php echo $escape($propertyRow['o:is_required']); ?>">
     <input class="is-private" type="hidden" name="<?php echo $escape($namePrefix . '[o:is_private]'); ?>" value="<?php echo $escape($propertyRow['o:is_private']); ?>">