Skip to content

Commit 5ed8c1f

Browse files
ryanbrainardryanbrainard
committed
Escape output in asyncStatus
1 parent 461b682 commit 5ed8c1f

File tree

1 file changed

+32
-32
lines changed

1 file changed

+32
-32
lines changed

‎workbench/asyncStatus.php

Lines changed: 32 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -52,44 +52,44 @@
5252
print "<table width='100%' cellpadding='5' class='lightlyBoxed'>";
5353

5454
print "<tr>" .
55-
"<td class='dataLabel'>Status</td><td class='dataValue'>" . $jobInfo->getState() . "</td>" .
56-
"<td class='dataLabel'>Records Processed</td><td class='dataValue'>" . $jobInfo->getNumberRecordsProcessed() . "</td>" .
57-
"<td class='dataLabel'>Batches Queued</td><td class='dataValue'>" . $jobInfo->getNumberBatchesQueued() . "</td>" .
55+
"<td class='dataLabel'>Status</td><td class='dataValue'>" . htmlspecialchars($jobInfo->getState()) . "</td>" .
56+
"<td class='dataLabel'>Records Processed</td><td class='dataValue'>" . htmlspecialchars($jobInfo->getNumberRecordsProcessed()) . "</td>" .
57+
"<td class='dataLabel'>Batches Queued</td><td class='dataValue'>" . htmlspecialchars($jobInfo->getNumberBatchesQueued()) . "</td>" .
5858
"</tr>";
5959

6060
print "<tr>" .
61-
"<td class='dataLabel'>Object</td><td class='dataValue'>" . $jobInfo->getObject() . "</td>" .
61+
"<td class='dataLabel'>Object</td><td class='dataValue'>" . htmlspecialchars($jobInfo->getObject()) . "</td>" .
6262
(WorkbenchContext::get()->isApiVersionAtLeast(19.0)
63-
? "<td class='dataLabel'>Records Failed</td><td class='dataValue'>" . $jobInfo->getNumberRecordsFailed() . "</td>"
64-
: "<td class='dataLabel'>Content Type</td><td class='dataValue'>" . $jobInfo->getContentType() . "</td>"
63+
? "<td class='dataLabel'>Records Failed</td><td class='dataValue'>" . htmlspecialchars($jobInfo->getNumberRecordsFailed()) . "</td>"
64+
: "<td class='dataLabel'>Content Type</td><td class='dataValue'>" . htmlspecialchars($jobInfo->getContentType()) . "</td>"
6565
) .
66-
"<td class='dataLabel'>Batches In Progress</td><td class='dataValue'>" . $jobInfo->getNumberBatchesInProgress() . "</td>" .
66+
"<td class='dataLabel'>Batches In Progress</td><td class='dataValue'>" . htmlspecialchars($jobInfo->getNumberBatchesInProgress()) . "</td>" .
6767
"</tr>";
6868

6969
print "<tr>" .
70-
"<td class='dataLabel'>Operation</td><td class='dataValue'>" . ucwords($jobInfo->getOpertion()). "</td>" .
71-
"<td class='dataLabel'>Concurrency Mode</td><td class='dataValue'>" . $jobInfo->getConcurrencyMode() . "</td>" .
72-
"<td class='dataLabel'>Batches Completed</td><td class='dataValue'>" . $jobInfo->getNumberBatchesCompleted() . "</td>" .
70+
"<td class='dataLabel'>Operation</td><td class='dataValue'>" . ucwords(htmlspecialchars($jobInfo->getOpertion()). "</td>" .
71+
"<td class='dataLabel'>Concurrency Mode</td><td class='dataValue'>" . htmlspecialchars($jobInfo->getConcurrencyMode()) . "</td>" .
72+
"<td class='dataLabel'>Batches Completed</td><td class='dataValue'>" . htmlspecialchars($jobInfo->getNumberBatchesCompleted()) . "</td>" .
7373
"</tr>";
7474

7575
print "<tr>" .
76-
"<td class='dataLabel'>External Id</td><td class='dataValue'>" . $jobInfo->getExternalIdFieldName(). "</td>" .
77-
"<td class='dataLabel'>API Version</td><td class='dataValue'>" . $jobInfo->getApiVersion() . "</td>" .
78-
"<td class='dataLabel'>Batches Failed</td><td class='dataValue'>" . $jobInfo->getNumberBatchesFailed() . "</td>" .
76+
"<td class='dataLabel'>External Id</td><td class='dataValue'>" . htmlspecialchars($jobInfo->getExternalIdFieldName()) . "</td>" .
77+
"<td class='dataLabel'>API Version</td><td class='dataValue'>" . htmlspecialchars($jobInfo->getApiVersion()) . "</td>" .
78+
"<td class='dataLabel'>Batches Failed</td><td class='dataValue'>" . htmlspecialchars($jobInfo->getNumberBatchesFailed()) . "</td>" .
7979
"</tr>";
8080

8181
if (WorkbenchContext::get()->isApiVersionAtLeast(19.0)) {
8282
print "<tr>" .
83-
"<td class='dataLabel'>API Processing</td><td class='dataValue'>" . $jobInfo->getApiActiveProcessingTime(). " ms</td>" .
84-
"<td class='dataLabel'>Apex Processing</td><td class='dataValue'>" . $jobInfo->getApexProcessingTime() . " ms</td>" .
85-
"<td class='dataLabel'>Total Processing</td><td class='dataValue'>" . $jobInfo->getTotalProcessingTime() . " ms</td>" .
83+
"<td class='dataLabel'>API Processing</td><td class='dataValue'>" . htmlspecialchars($jobInfo->getApiActiveProcessingTime()) . " ms</td>" .
84+
"<td class='dataLabel'>Apex Processing</td><td class='dataValue'>" . htmlspecialchars($jobInfo->getApexProcessingTime()) . " ms</td>" .
85+
"<td class='dataLabel'>Total Processing</td><td class='dataValue'>" . htmlspecialchars($jobInfo->getTotalProcessingTime()) . " ms</td>" .
8686
"</tr>";
8787
}
8888

8989
print "<tr>" .
90-
"<td class='dataLabel'>Created</td><td class='dataValue'>" . localizeDateTimes($jobInfo->getCreatedDate(),$timeOnlyFormat) . "</td>" .
91-
"<td class='dataLabel'>Last Modified</td><td class='dataValue'>" . localizeDateTimes($jobInfo->getSystemModstamp(),$timeOnlyFormat) . "</td>" .
92-
"<td class='dataLabel'>Retries</td><td class='dataValue'>" . $jobInfo->getNumberRetries() . "</td>" .
90+
"<td class='dataLabel'>Created</td><td class='dataValue'>" . localizeDateTimes(htmlspecialchars($jobInfo->getCreatedDate()), $timeOnlyFormat) . "</td>" .
91+
"<td class='dataLabel'>Last Modified</td><td class='dataValue'>" . localizeDateTimes(htmlspecialchars($jobInfo->getSystemModstamp()) ,$timeOnlyFormat) . "</td>" .
92+
"<td class='dataLabel'>Retries</td><td class='dataValue'>" . htmlspecialchars($jobInfo->getNumberRetries()) . "</td>" .
9393
"</tr>";
9494

9595
print "</table>";
@@ -118,39 +118,39 @@
118118
$batchResultList = $asyncConnection->getBatchResultList($jobInfo->getId(), $batchInfo->getId());
119119
}
120120
foreach($batchResultList as $resultId) {
121-
print "<a href='downloadAsyncBatch.php?op=result&jobId=" . $jobInfo->getId() . "&batchId=" . $batchInfo->getId() . "&resultId=" . $resultId . "'>" .
122-
"<img src='" . getPathToStaticResource('/images/downloadIcon' . $batchInfo->getState() . '.gif') . "' border='0' onmouseover=\"Tip('Download " . $batchInfo->getState() . " Batch Results')\"/>" .
121+
print "<a href='downloadAsyncBatch.php?op=result&jobId=" . htmlspecialchars($jobInfo->getId()) . "&batchId=" . htmlspecialchars($batchInfo->getId()) . "&resultId=" . $resultId . "'>" .
122+
"<img src='" . getPathToStaticResource('/images/downloadIcon' . htmlspecialchars($batchInfo->getState()) . '.gif') . "' border='0' onmouseover=\"Tip('Download " . htmlspecialchars($batchInfo->getState()) . " Batch Results')\"/>" .
123123
"</a><br/>";
124124
}
125125
} else {
126126
print "&nbsp;";
127127
}
128128
print "</td>";
129129

130-
$processingTimeDetails = "API Processing: " . $batchInfo->getApiActiveProcessingTime() . " ms<br/>" .
131-
"Apex Processing: " . $batchInfo->getApexProcessingTime() . " ms<br/>" .
132-
"Total Processing: " . $batchInfo->getTotalProcessingTime() . " ms<br/>";
130+
$processingTimeDetails = "API Processing: " . htmlspecialchars($batchInfo->getApiActiveProcessingTime()) . " ms<br/>" .
131+
"Apex Processing: " . htmlspecialchars($batchInfo->getApexProcessingTime()) . " ms<br/>" .
132+
"Total Processing: " . htmlspecialchars($batchInfo->getTotalProcessingTime()) . " ms<br/>";
133133

134134
print "<td class='dataValue'>" .
135135
(WorkbenchContext::get()->isApiVersionAtLeast(19.0)
136-
? "<a href='downloadAsyncBatch.php?op=request&jobId=" . $jobInfo->getId() . "&batchId=" . $batchInfo->getId() .
137-
"' onmouseover=\"Tip('Download Batch Request')\"/>" . $batchInfo->getId() . "</a>"
138-
: $batchInfo->getId()) .
136+
? "<a href='downloadAsyncBatch.php?op=request&jobId=" . htmlspecialchars($jobInfo->getId()) . "&batchId=" . htmlspecialchars($batchInfo->getId()) .
137+
"' onmouseover=\"Tip('Download Batch Request')\"/>" . htmlspecialchars($batchInfo->getId()) . "</a>"
138+
: htmlspecialchars($batchInfo->getId())) .
139139
"</td>" .
140-
"<td class='dataValue'>" . $batchInfo->getState() . (($batchInfo->getStateMessage() != "") ? (": " . $batchInfo->getStateMessage()) : "") . "</td>" .
140+
"<td class='dataValue'>" . htmlspecialchars($batchInfo->getState()) . (($batchInfo->getStateMessage() != "") ? (": " . htmlspecialchars($batchInfo->getStateMessage())) : "") . "</td>" .
141141
(WorkbenchContext::get()->isApiVersionAtLeast(19.0)
142142
? "<td class='dataValue pseudoLink' style='cursor: default' onmouseover=\"Tip('$processingTimeDetails')\"/>"
143143
: "<td class='dataValue'>") .
144-
$batchInfo->getNumberRecordsProcessed() . ($batchInfo->getNumberRecordsProcessed() == "1" ? " record" : " records") .
144+
htmlspecialchars($batchInfo->getNumberRecordsProcessed()) . (htmlspecialchars($batchInfo->getNumberRecordsProcessed()) == "1" ? " record" : " records") .
145145
"</td>" .
146146
(WorkbenchContext::get()->isApiVersionAtLeast(19.0)
147-
? "<td class='dataValue'>" . $batchInfo->getNumberRecordsFailed() .
147+
? "<td class='dataValue'>" . htmlspecialchars($batchInfo->getNumberRecordsFailed()) .
148148
($batchInfo->getNumberRecordsFailed() == "1"
149149
? " record"
150150
: " records") . "</td>"
151151
: "").
152-
"<td class='dataValue'>" . localizeDateTimes($batchInfo->getCreatedDate(),$timeOnlyFormat) . "</td>" .
153-
"<td class='dataValue'>" . localizeDateTimes($batchInfo->getSystemModstamp(),$timeOnlyFormat) . "</td>";
152+
"<td class='dataValue'>" . localizeDateTimes(htmlspecialchars($batchInfo->getCreatedDate()), $timeOnlyFormat) . "</td>" .
153+
"<td class='dataValue'>" . localizeDateTimes(htmlspecialchars($batchInfo->getSystemModstamp()), $timeOnlyFormat) . "</td>";
154154

155155
print "</tr>";
156156
}

0 commit comments

Comments
 (0)