Merge branch 'main' into widget-newsletter-form

empiricompany · Jul 28, 2024 · 1f08822 · 1f08822
2 parents f934391 + aae9232
commit 1f08822
Show file tree

Hide file tree

Showing 3 changed files with 50 additions and 5 deletions.
diff --git a/app/code/core/Mage/Core/Model/Security/HtmlEscapedString.php b/app/code/core/Mage/Core/Model/Security/HtmlEscapedString.php
@@ -0,0 +1,35 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ *
+ */
+class Mage_Core_Model_Security_HtmlEscapedString implements Stringable
+{
+    protected $originalValue;
+    protected $allowedTags;
+
+    /**
+     * @param string $originalValue
+     * @param string[]|null $allowedTags
+     */
+    public function __construct(string $originalValue, ?array $allowedTags = null)
+    {
+        $this->originalValue = $originalValue;
+        $this->allowedTags = $allowedTags;
+    }
+
+    public function __toString(): string
+    {
+        return (string) Mage::helper('core')->escapeHtml(
+            $this->originalValue,
+            $this->allowedTags
+        );
+    }
+
+    public function getUnescapedValue(): string
+    {
+        return $this->originalValue;
+    }
+}
diff --git a/app/code/core/Mage/Page/Block/Html/Header.php b/app/code/core/Mage/Page/Block/Html/Header.php
@@ -57,7 +57,9 @@ public function setLogo($logo_src, $logo_alt)
     public function getLogoSrc()
     {
         if (empty($this->_data['logo_src'])) {
-            $this->_data['logo_src'] = Mage::getStoreConfig('design/header/logo_src');
+            $this->_data['logo_src'] =  new Mage_Core_Model_Security_HtmlEscapedString(
+                (string) Mage::getStoreConfig('design/header/logo_src')
+            );
         }
         return $this->getSkinUrl($this->_data['logo_src']);
     }
@@ -68,7 +70,9 @@ public function getLogoSrc()
     public function getLogoSrcSmall()
     {
         if (empty($this->_data['logo_src_small'])) {
-            $this->_data['logo_src_small'] = Mage::getStoreConfig('design/header/logo_src_small');
+            $this->_data['logo_src_small'] =  new Mage_Core_Model_Security_HtmlEscapedString(
+                (string) Mage::getStoreConfig('design/header/logo_src_small')
+            );
         }
         return $this->getSkinUrl($this->_data['logo_src_small']);
     }
@@ -79,7 +83,9 @@ public function getLogoSrcSmall()
     public function getLogoAlt()
     {
         if (empty($this->_data['logo_alt'])) {
-            $this->_data['logo_alt'] = Mage::getStoreConfig('design/header/logo_alt');
+            $this->_data['logo_alt'] = new Mage_Core_Model_Security_HtmlEscapedString(
+                (string) Mage::getStoreConfig('design/header/logo_alt')
+            );
         }
         return $this->_data['logo_alt'];
     }
@@ -97,7 +103,9 @@ public function getWelcome()
             if (Mage::isInstalled() && Mage::getSingleton('customer/session')->isLoggedIn()) {
                 $this->_data['welcome'] = $this->__('Welcome, %s!', $this->escapeHtml(Mage::getSingleton('customer/session')->getCustomer()->getName()));
             } else {
-                $this->_data['welcome'] = Mage::getStoreConfig('design/header/welcome');
+                $this->_data['welcome'] = new Mage_Core_Model_Security_HtmlEscapedString(
+                    (string) Mage::getStoreConfig('design/header/welcome')
+                );
             }
         }
 

diff --git a/app/code/core/Mage/Page/Block/Html/Welcome.php b/app/code/core/Mage/Page/Block/Html/Welcome.php
@@ -44,7 +44,9 @@ protected function _toHtml()
             if (Mage::isInstalled() && $this->_getSession()->isLoggedIn()) {
                 $this->_data['welcome'] = $this->__('Welcome, %s!', $this->escapeHtml($this->_getSession()->getCustomer()->getName()));
             } else {
-                $this->_data['welcome'] = Mage::getStoreConfig('design/header/welcome');
+                $this->_data['welcome'] = new Mage_Core_Model_Security_HtmlEscapedString(
+                    (string) Mage::getStoreConfig('design/header/welcome')
+                );
             }
         }