Daniel/hotel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixed: Add input validation for back office forms and templates

Browse Source
This commit is contained in:
amit sharma
2026-09-30 16:59:47 +05:30
parent d8cf510fe5
commit bdf70f0f36
7 changed files with 24 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
admin-dev/themes/default/template/controllers/modules_positions/form.tpl
View File

@@ -100,8 +100,12 @@
var len = values.length;
list.find('option').prop('selected', false);
for (var i = 0; i < len; i++)
list.find('option[value="' + $.trim(values[i]) + '"]').prop('selected', true);
for (var i = 0; i < len; i++) {
var value = $.trim(values[i]);
list.find('option').filter(function() {
return this.value === value;
}).prop('selected', true);
}
}
function position_exception_listchange() {
var obj = $(this);

2
admin-dev/themes/default/template/controllers/products/booked_room_date_ranges_list.tpl
View File

@@ -20,7 +20,7 @@
* @license https://opensource.org/license/osl-3-0-php Open Software License version 3.0
*}
{sprintf({l s='The room "%s" already has a booking for the selected date range.'}, $orderDetails->room_num)}
{sprintf({l s='The room "%s" already has a booking for the selected date range.'}, $orderDetails->room_num|escape:'html':'UTF-8')}
<div class="row">
<div class="col-xs-12">
<span class="error_message_label">{l s='Order ID'}:</span> <a href="{$link->getAdminLink('AdminOrders')}&id_order={$orderDetails->id_order}&vieworder" target="_blank"><strong>#{$orderDetails->id_order|intval}</strong></a>

10
admin-dev/themes/default/template/controllers/products/configuration.tpl
View File

@@ -95,20 +95,20 @@
<input type="checkbox" {if isset($room_info['id'])}value="{$room_info['id']}"{else}disabled{/if} name="selected_room_ids[]">
</td>
<td class="col-sm-1 center">
<input class="form-control" type="text" value="{$room_info['room_num']}" name="{$var_name_room_info|cat:'[room_num]'}">
<input class="form-control" type="text" value="{$room_info['room_num']|escape:'html':'UTF-8'}" name="{$var_name_room_info|cat:'[room_num]'}">
</td>
<td class="col-sm-2 center">
<input class="form-control" type="text" value="{$room_info['floor']}" name="{$var_name_room_info|cat:'[floor]'}">
<input class="form-control" type="text" value="{$room_info['floor']|escape:'html':'UTF-8'}" name="{$var_name_room_info|cat:'[floor]'}">
</td>
<td class="col-sm-2 center">
<select class="form-control room_status" name="{$var_name_room_info|cat:'[id_status]'}">
{foreach from=$rm_status item=room_stauts}
<option value="{$room_stauts['id']}" {if $room_info['id_status'] == {$room_stauts['id']}}selected="selected"{/if}>{$room_stauts['status']}</option>
<option value="{$room_stauts['id']}" {if $room_info['id_status'] == {$room_stauts['id']}}selected="selected"{/if}>{$room_stauts['status']|escape:'html':'UTF-8'}</option>
{/foreach}
</select>
</td>
<td class="col-sm-3 center">
<input type="text" class="form-control room_comment" value="{if isset($room_info['comment'])}{$room_info['comment']}{/if}" name="{$var_name_room_info|cat:'[comment]'}">
<input type="text" class="form-control room_comment" value="{if isset($room_info['comment'])}{$room_info['comment']|escape:'html':'UTF-8'}{/if}" name="{$var_name_room_info|cat:'[comment]'}">
</td>
<td class="col-sm-2 center">
<a class="btn btn-default deactiveDatesModal {if $room_info['id_status'] != $rm_status['STATUS_TEMPORARY_INACTIVE']['id'] }disabled{/if}" data-toggle="modal" data-target="#deactiveDatesModal" data-id-room="{if isset($room_info['id'])}{$room_info['id']}{/if}">{if $room_info['id_status'] != $rm_status['STATUS_TEMPORARY_INACTIVE']['id'] }{l s='Add Dates'}{else}{l s='View Dates'}{/if}
@@ -1609,7 +1609,7 @@
roomNum = '( '+'{l s='%s No' sprintf=$htl_room_type['selling_object_plural_name']}'+' '+roomNum+')';
}
$('#deactiveDatesModal .disable_dates_room_num').html(roomNum);
$('#deactiveDatesModal .disable_dates_room_num').text(roomNum);
if (isNaN(idRoom)) {
DisableDatesObj.restrictCalendarActions();
return;

4
admin-dev/themes/default/template/controllers/products/lengthofstay.tpl
View File

@@ -148,13 +148,13 @@
</td>
<td>
<div class="input-group">
<input class="form-control" type="text" name="restriction_min_los[]" value="{$restrictionInfo['min_los']}">
<input class="form-control" type="text" name="restriction_min_los[]" value="{$restrictionInfo['min_los']|escape:'html':'UTF-8'}">
<span class="input-group-addon">{l s='day(s)'}</span>
</div>
</td>
<td>
<div class="input-group">
<input class="form-control" type="text" name="restriction_max_los[]" value="{$restrictionInfo['max_los']}">
<input class="form-control" type="text" name="restriction_max_los[]" value="{$restrictionInfo['max_los']|escape:'html':'UTF-8'}">
<span class="input-group-addon">{l s='day(s)'}</span>
</div>
</td>

10
controllers/admin/AdminModulesPositionsController.php
View File

@@ -446,11 +446,11 @@ class AdminModulesPositionsControllerCore extends AdminController
$file_list = ($file_list) ? array($file_list) : array();
}
$content = '<p><input type="text" name="exceptions['.$shop_id.']" value="'.implode(', ', $file_list).'" id="em_text_'.$shop_id.'" placeholder="'.$this->l('E.g. address, addresses, attachment').'"/></p>';
$content = '<p><input type="text" name="exceptions['.(int) $shop_id.']" value="'.Tools::safeOutput(implode(', ', $file_list)).'" id="em_text_'.(int) $shop_id.'" placeholder="'.$this->l('E.g. address, addresses, attachment').'"/></p>';
if ($shop_id) {
$shop = new Shop($shop_id);
$content .= ' ('.$shop->name.')';
$content .= ' ('.Tools::safeOutput($shop->name).')';
}
$content .= '<p>
@@ -463,14 +463,14 @@ class AdminModulesPositionsControllerCore extends AdminController
foreach ($file_list as $k => $v) {
if (! array_key_exists($v, $controllers)) {
$content .= '<option value="'.$v.'">'.$v.'</option>';
$content .= '<option value="'.Tools::safeOutput($v).'">'.Tools::safeOutput($v).'</option>';
}
}
$content .= '<option disabled="disabled">'.$this->l('____________ CORE ____________').'</option>';
foreach ($controllers as $k => $v) {
$content .= '<option value="'.$k.'">'.$k.'</option>';
$content .= '<option value="'.Tools::safeOutput($k).'">'.Tools::safeOutput($k).'</option>';
}
$modules_controllers_type = array('admin' => $this->l('Admin modules controller'), 'front' => $this->l('Front modules controller'));
@@ -479,7 +479,7 @@ class AdminModulesPositionsControllerCore extends AdminController
$all_modules_controllers = Dispatcher::getModuleControllers($type);
foreach ($all_modules_controllers as $module => $modules_controllers) {
foreach ($modules_controllers as $cont) {
$content .= '<option value="module-'.$module.'-'.$cont.'">module-'.$module.'-'.$cont.'</option>';
$content .= '<option value="module-'.Tools::safeOutput($module.'-'.$cont).'">module-'.Tools::safeOutput($module.'-'.$cont).'</option>';
}
}
}

8
modules/hotelreservationsystem/controllers/admin/AdminHotelRoomsBookingController.php
View File

@@ -119,8 +119,8 @@ class AdminHotelRoomsBookingController extends ModuleAdminController
$hotelBranchesInfo = HotelBranchInformation::filterDataByHotelAccess($hotelBranchesInfo, $this->context->employee->id_profile, 'id');
if ($hotelBranchesInfo) {
if (Tools::getValue('date_from')) {
$date_from = Tools::getValue('date_from');
if (Tools::getValue('date_from') && Validate::isDate(Tools::getValue('date_from'))) {
$date_from = date('Y-m-d', strtotime(Tools::getValue('date_from')));
} else {
$date_from = date('Y-m-d');
}
@@ -144,7 +144,7 @@ class AdminHotelRoomsBookingController extends ModuleAdminController
}
if (Tools::getValue('id_hotel')) {
$id_hotel = Tools::getValue('id_hotel');
$id_hotel = (int) Tools::getValue('id_hotel');
} else {
if ($htl_info = $objHotelBranchInformation->hotelBranchesInfo(false, 1)) {
// filter hotels as per accessed hotels
@@ -160,7 +160,7 @@ class AdminHotelRoomsBookingController extends ModuleAdminController
}
if (Tools::getValue('id_room_type')) {
$id_room_type = Tools::getValue('id_room_type');
$id_room_type = (int) Tools::getValue('id_room_type');
} else {
$id_room_type = 0;
}

2
modules/hotelreservationsystem/views/templates/admin/hotel_rooms_booking/helpers/view/view.tpl
View File

@@ -167,7 +167,7 @@
{/if}
{/if}
</select>
<input type="hidden" name="search_id_room_type" id="search_id_room_type" value="{$id_room_type}">
<input type="hidden" name="search_id_room_type" id="search_id_room_type" value="{$id_room_type|escape:'htmlall':'UTF-8'}">
</div>
</div>
<div class="col-sm-12">