From 99c933e283cde757e56527fa0fc9f74776e702eb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20Guillot?= <contact@fredericguillot.com>
Date: Tue, 25 Feb 2014 18:00:36 -0500
Subject: [PATCH] Improve HTML escaping for translations

---
 templates/feed_items.php        |  4 ++--
 templates/feeds.php             |  2 +-
 templates/unread_items.php      |  4 ++--
 vendor/PicoTools/Helper.php     |  7 ++++++-
 vendor/PicoTools/Translator.php | 29 ++++++++++++++++++++++-------
 5 files changed, 33 insertions(+), 13 deletions(-)

diff --git a/templates/feed_items.php b/templates/feed_items.php
index 612433a..db8b59b 100644
--- a/templates/feed_items.php
+++ b/templates/feed_items.php
@@ -1,6 +1,6 @@
 <?php if (empty($items)): ?>
     <p class="alert">
-        <?= t('This subscription is empty, <a href="?action=unread">go back to unread items</a>') ?>
+        <?= tne('This subscription is empty, <a href="?action=unread">go back to unread items</a>') ?>
     </p>
 <?php else: ?>
 
@@ -8,7 +8,7 @@
         <h2><?= Helper\escape($feed['title']) ?> (<?= $nb_items ?>)</h2>
         <ul>
             <li>
-                <a href="?action=feed-items&amp;feed_id=<?= $feed['id'] ?>&amp;order=updated&amp;direction=<?= $direction == 'asc' ? 'desc' : 'asc' ?>"><?= t('sort by date<span class="hide-mobile"> (%s)</span>', $direction == 'desc' ? t('older first') : t('most recent first')) ?></a>
+                <a href="?action=feed-items&amp;feed_id=<?= $feed['id'] ?>&amp;order=updated&amp;direction=<?= $direction == 'asc' ? 'desc' : 'asc' ?>"><?= tne('sort by date<span class="hide-mobile"> (%s)</span>', $direction == 'desc' ? t('older first') : t('most recent first')) ?></a>
             </li>
             <li>
                 <a href="?action=mark-feed-as-read&amp;feed_id=<?= $feed['id'] ?>" data-action="mark-feed-read" data-feed-id="<?= $feed['id'] ?>"><?= t('mark all as read') ?></a>
diff --git a/templates/feeds.php b/templates/feeds.php
index 3a248ea..0021c18 100644
--- a/templates/feeds.php
+++ b/templates/feeds.php
@@ -15,7 +15,7 @@
 <?php else: ?>
 
     <?php if ($nothing_to_read): ?>
-        <p class="alert"><?= t('Nothing to read, do you want to <a href="?action=refresh-all" data-action="refresh-all">update your subscriptions?</a>') ?></p>
+        <p class="alert"><?= tne('Nothing to read, do you want to <a href="?action=refresh-all" data-action="refresh-all">update your subscriptions?</a>') ?></p>
     <?php endif ?>
 
     <section class="items">
diff --git a/templates/unread_items.php b/templates/unread_items.php
index a30d0e4..007a38f 100644
--- a/templates/unread_items.php
+++ b/templates/unread_items.php
@@ -3,10 +3,10 @@
 <?php else: ?>
 
     <div class="page-header">
-        <h2><?= t('<span id="page-counter">%s</span>unread items', isset($nb_items) ? $nb_items.' ' : '') ?></h2>
+        <h2><?= tne('<span id="page-counter">%s</span>unread items', isset($nb_items) ? $nb_items.' ' : '') ?></h2>
         <ul>
             <li>
-                <a href="?action=unread&amp;order=updated&amp;direction=<?= $direction == 'asc' ? 'desc' : 'asc' ?>"><?= t('sort by date<span class="hide-mobile"> (%s)</span>', $direction == 'desc' ? t('older first') : t('most recent first')) ?></a>
+                <a href="?action=unread&amp;order=updated&amp;direction=<?= $direction == 'asc' ? 'desc' : 'asc' ?>"><?= tne('sort by date<span class="hide-mobile"> (%s)</span>', $direction == 'desc' ? t('older first') : t('most recent first')) ?></a>
             </li>
             <li>
                 <a href="?action=mark-as-read" data-action="mark-all-read"><?= t('mark all as read') ?></a>
diff --git a/vendor/PicoTools/Helper.php b/vendor/PicoTools/Helper.php
index a3ea708..dee83aa 100644
--- a/vendor/PicoTools/Helper.php
+++ b/vendor/PicoTools/Helper.php
@@ -208,4 +208,9 @@ function form_email($name, $values = array(), array $errors = array(), array $at
 function form_date($name, $values = array(), array $errors = array(), array $attributes = array(), $class = '')
 {
     return form_input('date', $name, $values, $errors, $attributes, $class);
-}
\ No newline at end of file
+}
+
+function form_number($name, $values = array(), array $errors = array(), array $attributes = array(), $class = '')
+{
+    return form_input('number', $name, $values, $errors, $attributes, $class);
+}
diff --git a/vendor/PicoTools/Translator.php b/vendor/PicoTools/Translator.php
index 7144979..d0fb708 100644
--- a/vendor/PicoTools/Translator.php
+++ b/vendor/PicoTools/Translator.php
@@ -21,6 +21,24 @@ namespace PicoTools\Translator {
         \array_shift($args);
         \array_unshift($args, get($identifier, $identifier));
 
+        foreach ($args as &$arg) {
+            $arg = htmlspecialchars($arg, ENT_QUOTES, 'UTF-8', false);
+        }
+
+        return \call_user_func_array(
+            'sprintf',
+            $args
+        );
+    }
+
+
+    function translate_no_escaping($identifier)
+    {
+        $args = \func_get_args();
+
+        \array_shift($args);
+        \array_unshift($args, get($identifier, $identifier));
+
         return \call_user_func_array(
             'sprintf',
             $args
@@ -122,26 +140,23 @@ namespace PicoTools\Translator {
 
 namespace {
 
-    function t() {
+    function tne() {
+        return call_user_func_array('\PicoTools\Translator\translate_no_escaping', func_get_args());
+    }
 
+    function t() {
         return call_user_func_array('\PicoTools\Translator\translate', func_get_args());
     }
 
-
     function c() {
-
         return call_user_func_array('\PicoTools\Translator\currency', func_get_args());
     }
 
-
     function n() {
-
         return call_user_func_array('\PicoTools\Translator\number', func_get_args());
     }
 
-
     function dt() {
-
         return call_user_func_array('\PicoTools\Translator\datetime', func_get_args());
     }
 }
\ No newline at end of file