[Noalyss-commit] [noalyss] 04/04: Fix special char with input-select

[Dany De Bontridder]

sparkyx pushed a commit to branch master
in repository noalyss.

commit f92a724c0ce655038a16967c9f61b4d979ed61a9
Author: sparkyx <danydb@noalyss.eu>
AuthorDate: Tue Mar 9 14:28:53 2021 +0100

    Fix special char with input-select
---
 include/lib/inplace_edit.class.php |  2 ++
 include/lib/iselect.class.php      |  6 +++---
 scenario/inplace_edit.test.php     | 10 +++-------
 3 files changed, 8 insertions(+), 10 deletions(-)

diff --git a/include/lib/inplace_edit.class.php 
b/include/lib/inplace_edit.class.php
index 2a492dd..1868061 100644
--- a/include/lib/inplace_edit.class.php
+++ b/include/lib/inplace_edit.class.php
@@ -111,6 +111,7 @@ EOF;
     function value()
     {
         $v=$this->input->get_value();
+        $v=html_entity_decode($v);
          if ( $this->input instanceof ITextarea) {
             echo '<span class="input_text" id="'.$this->input->id.'edit" >';
             echo '<pre class="field_follow_up">';
@@ -140,6 +141,7 @@ EOF;
     function input() {
         ob_start();
         $v=$this->input->get_value();
+        $v=html_entity_decode($v);
         if ( $this->input instanceof ITextarea) {
             echo '<span class="" id="'.$this->input->id.'edit" >';
             echo '<pre class="field_follow_up">';
diff --git a/include/lib/iselect.class.php b/include/lib/iselect.class.php
index 35d515b..2df854e 100644
--- a/include/lib/iselect.class.php
+++ b/include/lib/iselect.class.php
@@ -65,7 +65,7 @@ class ISelect extends HtmlInput
         {
             
$checked=($this->selected==$this->value[$i]['value'])?"SELECTED":"";
             $a.='<OPTION VALUE="'.$this->value[$i]['value'].'" '.$checked.'>';
-            $a.=$this->value[$i]['label'];
+            $a.=strip_tags($this->value[$i]['label']);
         }
         $a.="</SELECT>";
         if ( $this->table == 1 )                 $a='<td>'.$a.'</td>';
@@ -80,7 +80,7 @@ class ISelect extends HtmlInput
         {
             if ($this->selected==$this->value[$i]['value'] )
             {
-                $r=h($this->value[$i]['label']);
+                
$r=htmlentities($this->value[$i]['label'],ENT_QUOTES|ENT_HTML5,'UTF-8',true);
 
             }
         }
@@ -96,7 +96,7 @@ class ISelect extends HtmlInput
         {
             if ($this->selected==$this->value[$i]['value'] )
             {
-                $r=h($this->value[$i]['label']);
+                $r=$this->value[$i]['label'];
 
             }
         }
diff --git a/scenario/inplace_edit.test.php b/scenario/inplace_edit.test.php
index aa5261a..ff67b7d 100644
--- a/scenario/inplace_edit.test.php
+++ b/scenario/inplace_edit.test.php
@@ -23,7 +23,7 @@
 if (!defined('ALLOWED'))
     die('Appel direct ne sont pas permis');
 //@description:Test the class Inplace_Edit , ajax and javascript
-
+$db=Dossier::connect();
 
 require_once NOALYSS_INCLUDE . '/lib/itext.class.php';
 require_once NOALYSS_INCLUDE . '/lib/inum.class.php';
@@ -44,13 +44,9 @@ if (!isset($_REQUEST["TestAjaxFile"])) {
     echo "TEXT #".$ajax_hello->input()."#";
     
     $select = new ISelect ("ajax_select");
+    $select->value=$db->make_array("select fd_id,fd_label from fiche_def order 
by 2");
     $select->id=uniqid("sel");
-    $select->value=[ 
-        ["value"=>1,"label"=>"ONE"],
-        ["value"=>2,"label"=>"TWO"],
-        ["value"=>3,"label"=>"THREE"],
-        ];
-    $select->selected="2";
+    $select->selected="10001";
     $ajax_select = new Inplace_Edit($select);
     $ajax_select->set_callback("ajax_test.php");
     $ajax_select->add_json_param("TestAjaxFile", __FILE__) ;