From f0cfbb8b0d73298511ec1266e95364aab8be125c Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Sat, 8 Sep 2012 13:22:02 +0200
Subject: [PATCH] Sec: XSS hole

Conflicts:
	htdocs/core/tpl/login.tpl.php
---
 htdocs/core/tpl/login.tpl.php              | 6 +++---
 htdocs/theme/bureau2crea/tpl/login.tpl.php | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/htdocs/core/tpl/login.tpl.php b/htdocs/core/tpl/login.tpl.php
index b359b033740..f761d9a7584 100644
--- a/htdocs/core/tpl/login.tpl.php
+++ b/htdocs/core/tpl/login.tpl.php
@@ -82,7 +82,7 @@ $(document).ready(function () {
 <input type="hidden" name="screenwidth" id="screenwidth" value="" />
 <input type="hidden" name="screenheight" id="screenheight" value="" />
 
-<table class="login_table" summary="<?php echo $title; ?>" cellpadding="0" cellspacing="0" border="0" align="center">
+<table class="login_table" summary="<?php echo dol_escape_htmltag($title); ?>" cellpadding="0" cellspacing="0" border="0" align="center">
 <tr class="vmenu"><td align="center"><?php echo $title; ?></td></tr>
 </table>
 <br>
@@ -96,14 +96,14 @@ $(document).ready(function () {
 <tr>
 <td valign="bottom"> &nbsp; <strong><label for="username"><?php echo $langs->trans('Login'); ?></label></strong> &nbsp; </td>
 <td valign="bottom" nowrap="nowrap">
-<input type="text" id="username" name="username" class="flat" size="15" maxlength="40" value="<?php echo GETPOST('username')?GETPOST('username'):$login; ?>" tabindex="1" />
+<input type="text" id="username" name="username" class="flat" size="15" maxlength="40" value="<?php echo dol_escape_htmltag(GETPOST('username')?GETPOST('username'):$login); ?>" tabindex="1" />
 </td>
 </tr>
 
 <!-- Password -->
 <tr><td valign="top" nowrap="nowrap"> &nbsp; <strong><label for="password"><?php echo $langs->trans('Password'); ?></label></strong> &nbsp; </td>
 <td valign="top" nowrap="nowrap">
-<input id="password" name="password" class="flat" type="password" size="15" maxlength="30" value="<?php echo $password; ?>" tabindex="2" />
+<input id="password" name="password" class="flat" type="password" size="15" maxlength="30" value="<?php echo dol_escape_htmltag($password); ?>" tabindex="2" />
 </td></tr>
 
 <?php
diff --git a/htdocs/theme/bureau2crea/tpl/login.tpl.php b/htdocs/theme/bureau2crea/tpl/login.tpl.php
index ec2f973cf81..5d3dc29a34f 100644
--- a/htdocs/theme/bureau2crea/tpl/login.tpl.php
+++ b/htdocs/theme/bureau2crea/tpl/login.tpl.php
@@ -89,8 +89,8 @@ $(document).ready(function () {
 
 <div id="parameterBox">
 
-<div id="logBox"><strong><label for="username"><?php echo $langs->trans('Login'); ?></label></strong><input type="text" id="username" name="username" class="flat" size="15" maxlength="40" value="<?php echo GETPOST('username')?GETPOST('username'):$login; ?>" tabindex="1" /></div>
-<div id="passBox"><strong><label for="password"><?php echo $langs->trans('Password'); ?></label></strong><input id="password" name="password" class="flat" type="password" size="15" maxlength="30" value="<?php echo $password; ?>" tabindex="2" /></div>
+<div id="logBox"><strong><label for="username"><?php echo $langs->trans('Login'); ?></label></strong><input type="text" id="username" name="username" class="flat" size="15" maxlength="40" value="<?php echo dol_escape_htmltag(GETPOST('username')?GETPOST('username'):$login); ?>" tabindex="1" /></div>
+<div id="passBox"><strong><label for="password"><?php echo $langs->trans('Password'); ?></label></strong><input id="password" name="password" class="flat" type="password" size="15" maxlength="30" value="<?php echo dol_escape_htmltag($password); ?>" tabindex="2" /></div>
 
 	<?php
 	if (! empty($hookmanager->resArray['options'])) {
@@ -189,4 +189,4 @@ $(document).ready(function () {
 </body>
 </html>
 
-<!-- END PHP TEMPLATE -->
\ No newline at end of file
+<!-- END PHP TEMPLATE -->