From 08359c0d19a82e14c6f0c1e2a9867131dba32cf4 Mon Sep 17 00:00:00 2001
From: Sebastian Grewe <sebastian@grewe.ca>
Date: Thu, 11 Jul 2013 15:53:38 +0200
Subject: [PATCH] Further escaping of user inputs

---
 public/templates/mmcFE/statistics/blocks/default.tpl          | 2 +-
 public/templates/mmcFE/statistics/blocks/small_table.tpl      | 2 +-
 .../templates/mmcFE/statistics/pool/contributors_hashrate.tpl | 4 ++--
 .../templates/mmcFE/statistics/pool/contributors_shares.tpl   | 4 ++--
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/public/templates/mmcFE/statistics/blocks/default.tpl b/public/templates/mmcFE/statistics/blocks/default.tpl
index f404673c..0856a269 100644
--- a/public/templates/mmcFE/statistics/blocks/default.tpl
+++ b/public/templates/mmcFE/statistics/blocks/default.tpl
@@ -57,7 +57,7 @@ target and network difficulty and assuming a zero variance scenario.
         {else if $BLOCKSFOUND[block].confirmations == -1}
           <font color="red">Orphan</font>
         {else}{$GLOBAL.confirmations - $BLOCKSFOUND[block].confirmations} left{/if}</td>
-        <td>{$BLOCKSFOUND[block].finder|default:"unknown"}</td>
+        <td>{$BLOCKSFOUND[block].finder|default:"unknown"|escape}</td>
         <td class="center">{$BLOCKSFOUND[block].time|date_format:"%d/%m %H:%M:%S"}</td>
         <td class="right">{$BLOCKSFOUND[block].difficulty|number_format:"2"}</td>
         <td class="right">{$BLOCKSFOUND[block].amount|number_format:"2"}</td>
diff --git a/public/templates/mmcFE/statistics/blocks/small_table.tpl b/public/templates/mmcFE/statistics/blocks/small_table.tpl
index 731d57ef..2b0f8aac 100644
--- a/public/templates/mmcFE/statistics/blocks/small_table.tpl
+++ b/public/templates/mmcFE/statistics/blocks/small_table.tpl
@@ -14,7 +14,7 @@
 {section block $BLOCKSFOUND}
       <tr class="{cycle values="odd,even"}">
         <td class="center"><a href="{$GLOBAL.blockexplorer}{$BLOCKSFOUND[block].height}" target="_blank">{$BLOCKSFOUND[block].height}</a></td>
-        <td>{$BLOCKSFOUND[block].finder|default:"unknown"}</td>
+        <td>{$BLOCKSFOUND[block].finder|default:"unknown"|escape}</td>
         <td class="center">{$BLOCKSFOUND[block].time|date_format:"%d/%m %H:%M:%S"}</td>
         <td class="right">{$BLOCKSFOUND[block].shares|number_format}</td>
       </tr>
diff --git a/public/templates/mmcFE/statistics/pool/contributors_hashrate.tpl b/public/templates/mmcFE/statistics/pool/contributors_hashrate.tpl
index a2a6ed58..b6168c36 100644
--- a/public/templates/mmcFE/statistics/pool/contributors_hashrate.tpl
+++ b/public/templates/mmcFE/statistics/pool/contributors_hashrate.tpl
@@ -17,7 +17,7 @@
       {math assign="estday" equation="round(reward / ( diff * pow(2,32) / ( hashrate * 1000 ) / 3600 / 24), 3)" diff=$DIFFICULTY reward=$REWARD hashrate=$CONTRIBHASHES[contrib].hashrate}
       <tr{if $GLOBAL.userdata.username == $CONTRIBHASHES[contrib].account}{assign var=listed value=1} style="background-color:#99EB99;"{else} class="{cycle values="odd,even"}"{/if}>
         <td>{$rank++}</td>
-        <td>{$CONTRIBHASHES[contrib].account}</td>
+        <td>{$CONTRIBHASHES[contrib].account|escape}</td>
         <td class="right">{$CONTRIBHASHES[contrib].hashrate|number_format}</td>
         <td class="right">{$estday|number_format:"3"}</td>
         {if $GLOBAL.config.price.currency}<td class="right">{($estday * $GLOBAL.price)|default:"n/a"|number_format:"2"}</td>{/if}
@@ -27,7 +27,7 @@
       {if $GLOBAL.userdata.hashrate > 0}{math assign="myestday" equation="round(reward / ( diff * pow(2,32) / ( hashrate * 1000 ) / 3600 / 24), 3)" diff=$DIFFICULTY reward=$REWARD hashrate=$GLOBAL.userdata.hashrate}{/if}
       <tr style="background-color:#99EB99;">
         <td>n/a</td>
-        <td>{$GLOBAL.userdata.username}</td>
+        <td>{$GLOBAL.userdata.username|escape}</td>
         <td class="right">{$GLOBAL.userdata.hashrate}</td>
         <td class="right">{$myestday|number_format:"3"|default:"n/a"}</td>
         {if $GLOBAL.config.price.currency}<td class="right">{($myestday * $GLOBAL.price)|default:"n/a"|number_format:"2"}</td>{/if}
diff --git a/public/templates/mmcFE/statistics/pool/contributors_shares.tpl b/public/templates/mmcFE/statistics/pool/contributors_shares.tpl
index 2a482209..232e76b2 100644
--- a/public/templates/mmcFE/statistics/pool/contributors_shares.tpl
+++ b/public/templates/mmcFE/statistics/pool/contributors_shares.tpl
@@ -14,14 +14,14 @@
 {section hashrate $CONTRIBSHARES}
       <tr{if $GLOBAL.userdata.username == $CONTRIBSHARES[hashrate].account}{assign var=listed value=1} style="background-color:#99EB99;"{else} class="{cycle values="odd,even"}"{/if}>
         <td>{$rank++}</td>
-        <td>{$CONTRIBSHARES[hashrate].account}</td>
+        <td>{$CONTRIBSHARES[hashrate].account|escape}</td>
         <td class="right">{$CONTRIBSHARES[hashrate].shares|number_format}</td>
       </tr>
 {/section}
 {if $listed != 1 && $GLOBAL.userdata.username|default:""}
       <tr style="background-color:#99EB99;">
         <td>n/a</td>
-        <td>{$GLOBAL.userdata.username}</td>
+        <td>{$GLOBAL.userdata.username|escape}</td>
         <td class="right">{$GLOBAL.userdata.shares.valid|number_format}</td>
       </tr>
 {/if}