Escape variables in sizequota module

Author: Jamie Snape

modules/sizequota/Notification.php

@@ -108,7 +108,7 @@ public function getExtraHtmlSimple($args)
         $free = number_format($free, 0, '.', '');
         $hFree = UtilityComponent::formatSize($free);
 
-        return '<div id="sizequotaFreeSpace" style="display:none;">'.$free.'</div>'.'<div id="sizequotaHFreeSpace" style="display:none;">'.$hFree.'</div>';
+        return '<div id="sizequotaFreeSpace" style="display:none;">'.htmlspecialchars($free, ENT_QUOTES, 'UTF-8').'</div>'.'<div id="sizequotaHFreeSpace" style="display:none;">'.htmlspecialchars($hFree, ENT_QUOTES, 'UTF-8').'</div>';
     }
 
     /**
@@ -143,7 +143,7 @@ public function getExtraHtmlRevision($args)
             $free = number_format($free, 0, '.', '');
             $hFree = UtilityComponent::formatSize($free);
 
-            return '<div id="sizequotaFreeSpace" style="display:none;">'.$free.'</div>'.'<div id="sizequotaHFreeSpace" style="display:none;">'.$hFree.'</div>';
+            return '<div id="sizequotaFreeSpace" style="display:none;">'.htmlspecialchars($free, ENT_QUOTES, 'UTF-8').'</div>'.'<div id="sizequotaHFreeSpace" style="display:none;">'.htmlspecialchars($hFree, ENT_QUOTES, 'UTF-8').'</div>';
         }
     }
 

modules/sizequota/views/config/folder.phtml

@@ -30,13 +30,13 @@ echo '<script type="text/javascript" src="'.$this->moduleWebroot.'/public/js/con
 
 </div>
 <span><?php echo $this->t('Current used space:'); ?>
-    <span id='hUsedSpaceValue'><?php echo $this->hUsedSpace; ?></span></span>
+    <span id='hUsedSpaceValue'><?php echo $this->escape($this->hUsedSpace); ?></span></span>
 <br/>
 <span><?php echo $this->t('Total space:'); ?>
-    <span id='hQuotaValue'><?php echo $this->hQuota; ?></span></span>
-<span style="display: none;" id="hFreeSpaceValue"><?php echo $this->hFreeSpace; ?></span>
-<span style="display: none;" id="quotaValue"><?php echo $this->quota; ?></span>
-<span style="display: none;" id="usedSpaceValue"><?php echo $this->usedSpace; ?></span>
+    <span id='hQuotaValue'><?php echo $this->escape($this->hQuota); ?></span></span>
+<span style="display: none;" id="hFreeSpaceValue"><?php echo $this->escape($this->hFreeSpace); ?></span>
+<span style="display: none;" id="quotaValue"><?php echo $this->escape($this->quota); ?></span>
+<span style="display: none;" id="usedSpaceValue"><?php echo $this->escape($this->usedSpace); ?></span>
 <div id='quotaChart' style="height: 200px; width: 400px; display: none;"></div>
 <br/>
 <?php
@@ -55,19 +55,19 @@ if ($this->isAdmin) {
                 $value = 1;
                 foreach (array('KB', 'MB', 'GB', 'TB') as $unit) {
                     $value *= 1024;
-                    echo '<option value="'.$value.'"';
+                    echo '<option value="'.$this->escape($value).'"';
                     if ($this->unitFormValue == $unit) {
                         echo ' selected="selected"';
                     }
-                    echo '>'.$unit.'</option>';
+                    echo '>'.$this->escape($unit).'</option>';
                 }
                 ?>
             </select>
 
             <div>
                 <?php echo $this->configForm['submitQuota']; ?>
             </div>
-            <input type="hidden" name="folderId" value="<?php echo $this->folder->getKey(); ?>"/>
+            <input type="hidden" name="folderId" value="<?php echo $this->escape($this->folder->getKey()); ?>"/>
     </form>
 <?php
 } ?>

modules/sizequota/views/config/index.phtml

@@ -48,11 +48,11 @@ $this->headScript()->appendFile($this->moduleWebroot.'/public/js/config/config.i
     $value = 1;
     foreach (array('KB', 'MB', 'GB', 'TB') as $unit) {
         $value *= 1024;
-        echo '<option value="'.$value.'"';
+        echo '<option value="'.$this->escape($value).'"';
         if ($this->unitValueUser == $unit) {
             echo ' selected="selected"';
         }
-        echo '>'.$unit.'</option>';
+        echo '>'.$this->escape($unit).'</option>';
     }
     echo "
           </select>
@@ -64,11 +64,11 @@ $this->headScript()->appendFile($this->moduleWebroot.'/public/js/config/config.i
     $value = 1;
     foreach (array('KB', 'MB', 'GB', 'TB') as $unit) {
         $value *= 1024;
-        echo '<option value="'.$value.'"';
+        echo '<option value="'.$this->escape($value).'"';
         if ($this->unitValueCommunity == $unit) {
             echo ' selected="selected"';
         }
-        echo '>'.$unit.'</option>';
+        echo '>'.$this->escape($unit).'</option>';
     }
     echo "
           </select>
@@ -78,5 +78,4 @@ $this->headScript()->appendFile($this->moduleWebroot.'/public/js/config/config.i
         </div>
       </form>";
     ?>
-
 </div>