From 1c479a740e1d078916a56cdfa06c7e969d8f79c2 Mon Sep 17 00:00:00 2001
From: Thomas Tanghus <thomas@tanghus.net>
Date: Sat, 16 Jun 2012 18:06:10 +0200
Subject: [PATCH] Fix string encoding probs.

---
 ajax/contacts.php                      |  2 +-
 ajax/editaddress.php                   | 13 ++++++++++++-
 index.php                              |  2 +-
 templates/part.contacts.php            |  2 +-
 templates/part.edit_address_dialog.php | 22 +++++++++-------------
 5 files changed, 24 insertions(+), 17 deletions(-)

diff --git a/ajax/contacts.php b/ajax/contacts.php
index 37d396cd..dbc9be5c 100644
--- a/ajax/contacts.php
+++ b/ajax/contacts.php
@@ -13,7 +13,7 @@ OCP\JSON::checkAppEnabled('contacts');
 $ids = OC_Contacts_Addressbook::activeIds(OCP\USER::getUser());
 $contacts = OC_Contacts_VCard::all($ids);
 $tmpl = new OCP\Template("contacts", "part.contacts");
-$tmpl->assign('contacts', $contacts);
+$tmpl->assign('contacts', $contacts, false);
 $page = $tmpl->fetchPage();
 
 OCP\JSON::success(array('data' => array( 'page' => $page )));
diff --git a/ajax/editaddress.php b/ajax/editaddress.php
index 969aeeba..2d7aba11 100644
--- a/ajax/editaddress.php
+++ b/ajax/editaddress.php
@@ -20,7 +20,18 @@ if($checksum) {
 	$line = OC_Contacts_App::getPropertyLineByChecksum($vcard, $checksum);
 	$element = $vcard->children[$line];
 	$adr = OC_Contacts_VCard::structureProperty($element);
-	$tmpl->assign('adr',$adr);
+	$types = array();
+	if(isset($adr['parameters']['TYPE'])) {
+		if(is_array($adr['parameters']['TYPE'])) {
+			$types = array_map('htmlspecialchars', $adr['parameters']['TYPE']);
+			$types = array_map('strtoupper', $types);
+		} else {
+			$types = array(strtoupper(htmlspecialchars($adr['parameters']['TYPE'])));
+		}
+	}
+	$tmpl->assign('types', $types, false);
+	$adr = array_map('htmlspecialchars', $adr['value']);
+	$tmpl->assign('adr', $adr, false);
 }
 
 $tmpl->assign('id',$id);
diff --git a/index.php b/index.php
index 74b7c43c..bdb52c12 100644
--- a/index.php
+++ b/index.php
@@ -66,7 +66,7 @@ $tmpl->assign('phone_types', $phone_types);
 $tmpl->assign('email_types', $email_types);
 $tmpl->assign('categories', $categories);
 $tmpl->assign('addressbooks', $addressbooks);
-$tmpl->assign('contacts', $contacts);
+$tmpl->assign('contacts', $contacts, false);
 $tmpl->assign('details', $details );
 $tmpl->assign('id',$id);
 $tmpl->printPage();
diff --git a/templates/part.contacts.php b/templates/part.contacts.php
index 00a61f72..57517505 100644
--- a/templates/part.contacts.php
+++ b/templates/part.contacts.php
@@ -8,5 +8,5 @@
 		}
 	}
 ?>
-	<li role="button" book-id="<?php echo $contact['addressbookid']; ?>" data-id="<?php echo $contact['id']; ?>"><a href="index.php?id=<?php echo $contact['id']; ?>"><?php echo $display; ?></a></li>
+	<li role="button" book-id="<?php echo $contact['addressbookid']; ?>" data-id="<?php echo $contact['id']; ?>"><a href="index.php?id=<?php echo $contact['id']; ?>"><?php echo htmlspecialchars($display); ?></a></li>
 <?php endforeach; ?>
diff --git a/templates/part.edit_address_dialog.php b/templates/part.edit_address_dialog.php
index 7684795f..d5ea95ba 100644
--- a/templates/part.edit_address_dialog.php
+++ b/templates/part.edit_address_dialog.php
@@ -1,13 +1,9 @@
 <?php
 $adr = isset($_['adr'])?$_['adr']:array();
-$id = $_['id'];
-$types = array();
-foreach(isset($adr['parameters']['TYPE'])?array($adr['parameters']['TYPE']):array() as $type) {
-	$types[] = strtoupper($type);
-}
+$id = isset($_['id'])?$_['id']:array();
+$types = isset($_['types'])?$_['types']:array();
 ?>
 <div id="edit_address_dialog" title="<?php echo $l->t('Edit address'); ?>">
-<!-- ?php print_r($types); ? -->
 	<fieldset id="address">
 		<dl class="form">
 			<dt>
@@ -22,43 +18,43 @@ foreach(isset($adr['parameters']['TYPE'])?array($adr['parameters']['TYPE']):arra
 				<label class="label" for="adr_pobox"><?php echo $l->t('PO Box'); ?></label>
 			</dt>
 			<dd>
-				<input type="text" id="adr_pobox" name="value[ADR][0]" placeholder="<?php echo $l->t('PO Box'); ?>" value="<?php echo isset($adr['value'][0])?$adr['value'][0]:''; ?>">
+				<input type="text" id="adr_pobox" name="value[ADR][0]" placeholder="<?php echo $l->t('PO Box'); ?>" value="<?php echo isset($adr[0])?$adr[0]:''; ?>">
 			</dd>
 			<dt>
 				<label class="label" for="adr_street"><?php echo $l->t('Street address'); ?></label>
 			</dt>
 			<dd>
-				<input type="text" id="adr_street" name="value[ADR][2]" placeholder="<?php echo $l->t('Street and number'); ?>" value="<?php echo isset($adr['value'][2])?$adr['value'][2]:''; ?>">
+				<input type="text" id="adr_street" name="value[ADR][2]" placeholder="<?php echo $l->t('Street and number'); ?>" value="<?php echo isset($adr[2])?$adr[2]:''; ?>">
 			</dd>
 			<dt>
 				<label class="label" for="adr_extended"><?php echo $l->t('Extended'); ?></label>
 			</dt>
 			<dd>
-				<input type="text" id="adr_extended" name="value[ADR][1]" placeholder="<?php echo $l->t('Apartment number etc.'); ?>" value="<?php echo isset($adr['value'][1])?$adr['value'][1]:''; ?>">
+				<input type="text" id="adr_extended" name="value[ADR][1]" placeholder="<?php echo $l->t('Apartment number etc.'); ?>" value="<?php echo isset($adr[1])?$adr[1]:''; ?>">
 			</dd>
 			<dt>
 				<label class="label" for="adr_city"><?php echo $l->t('City'); ?></label>
 			</dt>
 			<dd>
-				<input type="text" id="adr_city" name="value[ADR][3]" placeholder="<?php echo $l->t('City'); ?>" value="<?php echo isset($adr['value'][3])?$adr['value'][3]:''; ?>">
+				<input type="text" id="adr_city" name="value[ADR][3]" placeholder="<?php echo $l->t('City'); ?>" value="<?php echo isset($adr[3])?$adr[3]:''; ?>">
 			</dd>
 			<dt>
 				<label class="label" for="adr_region"><?php echo $l->t('Region'); ?></label>
 			</dt>
 			<dd>
-				<input type="text" id="adr_region" name="value[ADR][4]" placeholder="<?php echo $l->t('E.g. state or province'); ?>" value="<?php echo isset($adr['value'][4])?$adr['value'][4]:''; ?>">
+				<input type="text" id="adr_region" name="value[ADR][4]" placeholder="<?php echo $l->t('E.g. state or province'); ?>" value="<?php echo isset($adr[4])?$adr[4]:''; ?>">
 			</dd>
 			<dt>
 				<label class="label" for="adr_zipcode"><?php echo $l->t('Zipcode'); ?></label>
 			</dt>
 			<dd>
-				<input type="text" id="adr_zipcode" name="value[ADR][5]" placeholder="<?php echo $l->t('Postal code'); ?>" value="<?php echo isset($adr['value'][5])?$adr['value'][5]:''; ?>">
+				<input type="text" id="adr_zipcode" name="value[ADR][5]" placeholder="<?php echo $l->t('Postal code'); ?>" value="<?php echo isset($adr[5])?$adr[5]:''; ?>">
 			</dd>
 			<dt>
 				<label class="label" for="adr_country"><?php echo $l->t('Country'); ?></label>
 			</dt>
 			<dd>
-				<input type="text" id="adr_country" name="value[ADR][6]" placeholder="<?php echo $l->t('Country'); ?>" value="<?php echo isset($adr['value'][6])?$adr['value'][6]:''; ?>">
+				<input type="text" id="adr_country" name="value[ADR][6]" placeholder="<?php echo $l->t('Country'); ?>" value="<?php echo isset($adr[6])?$adr[6]:''; ?>">
 			</dd>
 		</dl>
 	</fieldset>