5f85fcd863
I reviewed character escaping everywhere with the following ideas:
* use a single common function to escape user data: `escape` using `htmlspecialchars`.
* sanitize fields in `index.php` after reading them from datastore and before sending them to templates.
It means no escaping function in Twig templates.
2 reasons:
* it reduces risks of security issue for future user made templates
* more readable templates
* sanitize user configuration fields after loading them.
44 lines
1.3 KiB
HTML
44 lines
1.3 KiB
HTML
|
|
<div id="logo" title="Share your links !" onclick="document.location='?';"></div>
|
|
|
|
<div id="linkcount" class="nomobile">
|
|
{if="!empty($linkcount)"}{$linkcount} links{/if}
|
|
</div>
|
|
|
|
<div id="menu">
|
|
<ul>
|
|
<li><span id="shaarli_title">
|
|
<a href="{$titleLink}">{$shaarlititle}</a>
|
|
</span>
|
|
</li>
|
|
|
|
{if="!empty($_GET['source']) && $_GET['source']=='bookmarklet'"}
|
|
{ignore} When called as a popup from bookmarklet, do not display menu. {/ignore}
|
|
{else}
|
|
<li><a href="?" class="nomobile">Home</a></li>
|
|
{if="isLoggedIn()"}
|
|
<li><a href="?do=logout">Logout</a></li>
|
|
<li><a href="?do=tools">Tools</a></li>
|
|
<li><a href="?do=addlink">Add link</a></li>
|
|
{elseif="$GLOBALS['config']['OPEN_SHAARLI']"}
|
|
<li><a href="?do=tools">Tools</a></li>
|
|
<li><a href="?do=addlink">Add link</a></li>
|
|
{else}
|
|
<li><a href="?do=login">Login</a></li>
|
|
{/if}
|
|
<li><a href="{$feedurl}?do=rss{$searchcrits}" class="nomobile">RSS Feed</a></li>
|
|
{if="$GLOBALS['config']['SHOW_ATOM']"}
|
|
<li><a href="{$feedurl}?do=atom{$searchcrits}" class="nomobile">ATOM Feed</a></li>
|
|
{/if}
|
|
<li><a href="?do=tagcloud">Tag cloud</a></li>
|
|
<li><a href="?do=picwall{$searchcrits}">Picture wall</a></li>
|
|
<li><a href="?do=daily">Daily</a></li>
|
|
{/if}
|
|
</ul>
|
|
</div>
|
|
|
|
|
|
<div class="clear"></div>
|
|
|
|
|