Skip to content

Commit

Permalink
Applying security fix
Browse files Browse the repository at this point in the history
  • Loading branch information
sebastienros committed Jun 30, 2015
1 parent 91e1c72 commit 549efdb
Show file tree
Hide file tree
Showing 5 changed files with 179 additions and 22 deletions.
2 changes: 1 addition & 1 deletion src/Orchard.Web/Core/Shapes/Views/User.cshtml
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
<div class="user-display">
@if (WorkContext.CurrentUser != null) {
<span class="user-actions welcome">
@T("Welcome, <strong>{0}</strong>!", "<a href=\"" + @Url.Action("ChangePassword", new { Controller = "Account", Area = "Orchard.Users" }) + "\">" + @Html.ItemDisplayText(WorkContext.CurrentUser) + "</a>")
@T("Welcome, <strong>{0}</strong>!", Html.Raw("<a href=\"" + @Url.Action("ChangePassword", new { Controller = "Account", Area = "Orchard.Users" }) + "\">" + Html.ItemDisplayText(WorkContext.CurrentUser) + "</a>"))
</span>
<span class="user-actions">
@Html.ActionLink(T("Sign Out").ToString(), "LogOff", new { Controller = "Account", Area = "Orchard.Users", ReturnUrl = Context.Request.RawUrl }, new { rel = "nofollow" })
Expand Down
Original file line number Diff line number Diff line change
@@ -1,22 +1,117 @@
@model Orchard.Localization.ViewModels.EditLocalizationViewModel
<fieldset class="localization culture-selection">
@if (Model.ContentItem.ContentItem.Id > 0 && Model.SelectedCulture != null && Model.ContentLocalizations.Localizations.Count() > 0) {
@using System.Globalization
@{
Style.Require("LocalizationAdmin");
<fieldset class="culture-selected">
<label for="SelectedCulture">@T("Content Localization")</label>
<div>@T("This is the <em>{0}</em> variation of {1}.",
Html.Encode(Model.SelectedCulture),
Html.ItemEditLink(Model.MasterContentItem ?? Model.ContentItem))</div>
@Html.Hidden("SelectedCulture", Model.SelectedCulture)
</fieldset>
if (Model.ContentLocalizations.Localizations.Count() > 0) {
<dl class="content-localization">
<dt>@T("Other translations:")</dt>
<dd class="content-localizations">
@Html.UnorderedList(Model.ContentLocalizations.Localizations, (c, i) => Html.ItemEditLink(c.Culture.Culture, c), "localizations")
</dd>
</dl>
}
}
<div class="add-localization">@Html.ActionLink(T("+ New translation").Text, "Translate", "Admin", new { area = "Orchard.Localization", id = Model.ContentItem.Id }, null)</div>
}
<fieldset class="localization culture-selection">
<label for="@Html.FieldIdFor(m => m.SelectedCulture)">@T("Content Localization")</label>
<div>
@*Brand new content item*@
@if (Model.ContentItem.ContentItem.Id == 0) {
if (Model.MasterContentItem == null) {
@T("This is the <em>{0}</em> variation of the content",
BuildSelectedCultureList(
Html.FieldIdFor(m => m.SelectedCulture),
Html.FieldNameFor(m => m.SelectedCulture),
Model.MissingCultures,
Model.SelectedCulture))
}
else {
@T("This is the <em>{0}</em> variation of {1}",
BuildSelectedCultureList(
Html.FieldIdFor(m => m.SelectedCulture),
Html.FieldNameFor(m => m.SelectedCulture),
Model.MissingCultures,
Model.SelectedCulture),
Html.ItemEditLink(Model.MasterContentItem))
}
}

@if (Model.ContentItem.ContentItem.Id > 0) {
if (string.IsNullOrEmpty(Model.SelectedCulture)) {
@T("This content currently has no culture associated to it, please select a culture to associate to this piece of content: {0}",
BuildSelectedCultureList(
Html.FieldIdFor(m => m.SelectedCulture),
Html.FieldNameFor(m => m.SelectedCulture),
Model.MissingCultures,
Model.SelectedCulture))
}
else {
@T("This is the <em>{0}</em> variation of the content",
Html.Encode(Model.SelectedCulture))

if (Model.ContentLocalizations.Localizations.Any()) {
<dl class="content-localization">
<dt>@T("Other translations:")</dt>
<dd class="content-localizations">
@Html.UnorderedList(Model.ContentLocalizations.Localizations, (c, i) =>
Html.ItemEditLink(c.Culture.Culture, c), "localizations")
</dd>
</dl>
}

if (Model.MissingCultures.Any()) {
var contentItemId = Model.MasterContentItem != null ? Model.MasterContentItem.Id : Model.ContentItem.Id;

<div class="add-localization">@Html.ActionLink(T("+ New translation").Text, "Translate", "Admin", new {area = "Orchard.Localization", id = contentItemId}, null)</div>
}

@Html.Hidden(Html.FieldNameFor(m => m.SelectedCulture), Model.SelectedCulture)
}
}
</div>
</fieldset>



@functions{
private IHtmlString BuildSelectedCultureList(string id, string name, IEnumerable<string> siteCultures, string culture) {
TagBuilder selectTag = new TagBuilder("select");
selectTag.Attributes["id"] = id;
selectTag.Attributes["name"] = name;

foreach (var siteCulture in siteCultures) {
TagBuilder optionTag = new TagBuilder("option");
optionTag.Attributes["data-content-dir"] = CultureInfo.GetCultureInfo(siteCulture).TextInfo.IsRightToLeft ? "rtl" : "ltr";

if (siteCulture == culture) {
optionTag.Attributes["selected"] = "selected";
}
optionTag.SetInnerText(Html.Encode(siteCulture));
selectTag.InnerHtml += optionTag.ToString();
}

return Html.Raw(selectTag);
}
}
@using (Script.Foot()) {
<script type="text/javascript">
//<![CDATA[
(function($) {
"use strict";
var culture = $("#@Html.FieldIdFor(m => m.SelectedCulture)");
function flipCulture() {
var optionDirectionality = $("option:selected", culture).attr("data-content-dir");
var contentZone = $(".zone-content");
if (contentZone.hasClass(optionDirectionality))
return;
var oldClass = optionDirectionality === "ltr" ? "rtl" : "";
contentZone.removeClass("content-" + oldClass);
contentZone.addClass("content-" + optionDirectionality);
$(document).trigger("localization.ui.directionalitychanged", optionDirectionality);
}
culture.change(function () {
flipCulture();
});
flipCulture();
})(jQuery);
//]]>
</script>
}
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
<span class="hint">@T("Your private key.")</span>
</div>

@T("Get a free API Key on {0}", "<a href=\"http://datamarket.azure.com/dataset/bing/search\">http://datamarket.azure.com/dataset/bing/search</a>")
@T("Get a free API Key on {0}", Html.Raw("<a href=\"http://datamarket.azure.com/dataset/bing/search\">http://datamarket.azure.com/dataset/bing/search</a>"))
</fieldset>


Expand Down
62 changes: 62 additions & 0 deletions src/Orchard.Web/Orchard/Localization/Text.cs
Original file line number Diff line number Diff line change
@@ -0,0 +1,62 @@
using System;
using System.Globalization;
using System.Linq;
using System.Web;
using Orchard.Localization.Services;
using Orchard.Logging;

namespace Orchard.Localization {
public class Text : IText {
private readonly string _scope;
private readonly IWorkContextAccessor _workContextAccessor;
private readonly ILocalizedStringManager _localizedStringManager;

public Text(string scope, IWorkContextAccessor workContextAccessor, ILocalizedStringManager localizedStringManager) {
_scope = scope;
_workContextAccessor = workContextAccessor;
_localizedStringManager = localizedStringManager;
Logger = NullLogger.Instance;
}

public ILogger Logger { get; set; }

public LocalizedString Get(string textHint, params object[] args) {
Logger.Debug("{0} localizing '{1}'", _scope, textHint);

var workContext = _workContextAccessor.GetContext();

if (workContext != null) {
var currentCulture = workContext.CurrentCulture;
var localizedFormat = _localizedStringManager.GetLocalizedString(_scope, textHint, currentCulture);

return args.Length == 0
? new LocalizedString(localizedFormat, _scope, textHint, args)
: new LocalizedString(
String.Format(GetFormatProvider(currentCulture), localizedFormat, args.Select(Encode).ToArray()),
_scope,
textHint,
args);
}

return new LocalizedString(textHint, _scope, textHint, args);
}

private static IFormatProvider GetFormatProvider(string currentCulture) {
try {
return CultureInfo.GetCultureInfoByIetfLanguageTag(currentCulture);
}
catch {
return null;
}
}

static object Encode(object arg)
{
if (arg is IFormattable || arg is IHtmlString) {
return arg;
}

return HttpUtility.HtmlEncode(arg);
}
}
}
2 changes: 1 addition & 1 deletion src/Orchard.Web/Themes/TheAdmin/Views/Title.cshtml
Original file line number Diff line number Diff line change
@@ -1 +1 @@
<h1 id="page-title">@Model.Title.ToString()</h1>
<h1 id="page-title">@Model.Title</h1>

0 comments on commit 549efdb

Please sign in to comment.