From 44a53492e642ed310237221ba27b44cbe0c9c36d Mon Sep 17 00:00:00 2001
From: "Florian Aders (EleRas)" <eleras@froxlor.org>
Date: Thu, 23 Jun 2011 11:09:44 +0200
Subject: [PATCH] Moving to smarty - escaping in webftp, refs #819

Signed-off-by: Florian Aders (EleRas) <eleras@froxlor.org>
---
 templates/Froxlor/webftp/webftp_edit.tpl | 2 +-
 webftp.php                               | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/templates/Froxlor/webftp/webftp_edit.tpl b/templates/Froxlor/webftp/webftp_edit.tpl
index 59dc2905..44d579fb 100644
--- a/templates/Froxlor/webftp/webftp_edit.tpl
+++ b/templates/Froxlor/webftp/webftp_edit.tpl
@@ -24,7 +24,7 @@
 				<input type="hidden" name="currentDir" value="{$currentDir}" />
 				<input type="hidden" name="file" value="{$file}" />
 				<input type="hidden" name="mode" value="{$mode}" />
-			    <textarea name="fileContent" cols="80" rows="40" wrap="OFF" id="fileContent">{$myFileContent}</textarea>
+			    <textarea name="fileContent" cols="80" rows="40" wrap="OFF" id="fileContent">{$myFileContent|escape:'htmlall'}</textarea>
 			    <br>
 			    <input type="submit" name="Submit" value="{t}Save file{/t}" />
 			    <input type="button" name="Submit2" value="{t}Cancel{/t}" onClick="javascript:document.location.href='webftp.php?action=cd&amp;file={$currentDir}'" />
diff --git a/webftp.php b/webftp.php
index 324d9e19..283cf151 100644
--- a/webftp.php
+++ b/webftp.php
@@ -710,7 +710,7 @@ elseif ((!empty($_POST['loginname']) && !empty($_POST['password'])) || (!empty($
 						{
 							fclose($fp);
 							// temporäre Datei lesen und ausgeben
-							$myFileContent = htmlentities(implode("",file($downloadDir .  killslashes(html_entity_decode($file))."_".$s)));
+							$myFileContent = implode("",file($downloadDir .  killslashes(html_entity_decode($file))."_".$s));
 						}
 						$smarty->assign('myFileContent', $myFileContent);
 						unlink($downloadDir .  killslashes(html_entity_decode($file))."_".$s);