| Index: trunk/extensions/Storyboard/specials/Story/Story_body.php |
| — | — | @@ -121,7 +121,7 @@ |
| 122 | 122 | global $wgTitle; |
| 123 | 123 | $wgOut->addWikiMsg( |
| 124 | 124 | 'storyboard-canedit', |
| 125 | | - $this->getTitle( $story->story_title )->getFullURL( array( 'action' => 'edit' ) ) |
| | 125 | + htmlspecialchars( $this->getTitle( $story->story_title )->getFullURL( array( 'action' => 'edit' ) ) ) |
| 126 | 126 | ); |
| 127 | 127 | } |
| 128 | 128 | } |
| — | — | @@ -146,10 +146,10 @@ |
| 147 | 147 | |
| 148 | 148 | if ( $story->story_author_image != '' && $story->story_image_hidden != 1 ) { |
| 149 | 149 | $story->story_author_image = htmlspecialchars( $story->story_author_image ); |
| 150 | | - $wgOut->addHTML( "<img src='$story->story_author_image' class='story-image'>" ); |
| | 150 | + $wgOut->addHTML( "<img src=\"$story->story_author_image\" class='story-image'>" ); |
| 151 | 151 | } |
| 152 | 152 | |
| 153 | | - $wgOut->addWikiText( $story->story_text ); |
| | 153 | + $wgOut->addWikiText( $story->story_text ); |
| 154 | 154 | |
| 155 | 155 | // If the user that submitted the story was logged in, create a link to his/her user page. |
| 156 | 156 | if ( $story->story_author_id ) { |
| — | — | @@ -171,9 +171,9 @@ |
| 172 | 172 | // FIXME: this button is a temporary solution untill the SkinTemplateNavigation on special pages issue is fixed. |
| 173 | 173 | if ( $wgUser->isAllowed( 'storyreview' ) ) { |
| 174 | 174 | $editMsg = htmlspecialchars( wfMsg( 'edit' ) ); |
| 175 | | - $editUrl = $this->getTitle( $story->story_title )->getLocalURL( 'action=edit' ); |
| | 175 | + $editUrl = htmlspecialchars( $this->getTitle( $story->story_title )->getLocalURL( 'action=edit' ) ); |
| 176 | 176 | $wgOut->addHtml( |
| 177 | | - "<button type='button' onclick=\"window.location='$editUrl'\">$editMsg</button>" |
| | 177 | + "<button type='button' onclick='window.location=\"$editUrl\"'>$editMsg</button>" |
| 178 | 178 | ); |
| 179 | 179 | } |
| 180 | 180 | |
| — | — | @@ -205,7 +205,7 @@ |
| 206 | 206 | $minLen = $wgRequest->getVal( 'minlength' ); |
| 207 | 207 | if ( !is_int( $minLen ) ) $minLen = $egStoryboardMinStoryLen; |
| 208 | 208 | |
| 209 | | - $formBody = "<table width='$width'>"; |
| | 209 | + $formBody = "<table width=\"$width\">"; |
| 210 | 210 | |
| 211 | 211 | // The current value will be selected on page load with jQuery. |
| 212 | 212 | $formBody .= '<tr>' . |
| — | — | @@ -384,9 +384,10 @@ |
| 385 | 385 | |
| 386 | 386 | $wgOut->addHTML( $formBody ); |
| 387 | 387 | |
| | 388 | + $state = htmlspecialchars( $story->story_state ); |
| 388 | 389 | $wgOut->addInlineScript( <<<EOT |
| 389 | 390 | jQuery(document).ready(function() { |
| 390 | | - jQuery("#storystate option[value='$story->story_state']").attr('selected', 'selected'); |
| | 391 | + jQuery('#storystate option[value="$state"]').attr('selected', 'selected'); |
| 391 | 392 | |
| 392 | 393 | jQuery("#storyform").validate({ |
| 393 | 394 | messages: { |