Bug 133423 - Audit templates for FILTER usage

r=gerv, justdave

4 files changed, 8 insertions, 5 deletions

diff --git a/template/default/attachstatus/create.atml b/template/default/attachstatus/create.atml
index 128d811dc..7354b3852 100755
--- a/template/default/attachstatus/create.atml
+++ b/template/default/attachstatus/create.atml
@@ -58,7 +58,7 @@
       <td>
         <select name="product">
           [% FOREACH item = products %]
-            <option value="[% item %]">[% item %]</option>
+            <option value="[% item FILTER html %]">[% item FILTER html %]</option>
           [% END %]
         </select>
       </td>
diff --git a/template/default/attachstatus/delete.atml b/template/default/attachstatus/delete.atml
index 19648c6d0..dc50052b9 100644
--- a/template/default/attachstatus/delete.atml
+++ b/template/default/attachstatus/delete.atml
@@ -20,6 +20,9 @@
   #                 Jeff Hedlund <jeff.hedlund@matrixsi.com>
   #%]
 
+[%# Filter off the name here to be used multiple times below %]
+[% name = name FILTER html %]
+
 [% INCLUDE global/header 
   title = "Confirm Delete of Attachment Status '$name'" 
 %]
diff --git a/template/default/attachstatus/edit.atml b/template/default/attachstatus/edit.atml
index 366f8eb70..1186d7637 100755
--- a/template/default/attachstatus/edit.atml
+++ b/template/default/attachstatus/edit.atml
@@ -35,14 +35,14 @@
     <tr>
       <th>Name:</th>
       <td>
-        <input type="text" name="name" value="[% name %]" size="50" maxlength="50">
+        <input type="text" name="name" value="[% name FILTER html %]" size="50" maxlength="50">
       </td>
     </tr>
 
     <tr>
       <th>Description:</th>
       <td>
-        <textarea name="desc" rows="4" cols="50">[% desc %]</textarea>
+        <textarea name="desc" rows="4" cols="50">[% desc FILTER html %]</textarea>
       </td>
     </tr>
 
@@ -56,7 +56,7 @@
     <tr>
       <th>Product:</th>
       <td>
-        [% product %]
+        [% product FILTER html %]
       </td>
     </tr>
 
diff --git a/template/default/attachstatus/list.atml b/template/default/attachstatus/list.atml
index f2d0a4f51..551ab182a 100755
--- a/template/default/attachstatus/list.atml
+++ b/template/default/attachstatus/list.atml
@@ -43,7 +43,7 @@
       <td>[% statusdef.name FILTER html %]</td>
       <td>[% statusdef.description FILTER html %]</td>
       <td>[% statusdef.sortkey %]</td>
-      <td>[% statusdef.product %]</td>
+      <td>[% statusdef.product FILTER html %]</td>
       <td>
         <a href="editattachstatuses.cgi?action=edit&id=[% statusdef.id %]">
             Edit</a>