From 458c04afa14a14ab7a790af930e400d9b69fc511 Mon Sep 17 00:00:00 2001
From: adrien <adrien@malingrey.fr>
Date: Sun, 20 Oct 2024 13:44:55 +0200
Subject: [PATCH] remove htmlentities

---
 filter_inputs.php        |  2 +-
 index.php                |  6 +++---
 templates/hostsTable.xsl | 35 ++++-----------------------------
 templates/lib/toast.xsl  | 42 ++++++++++++++++++++++++++++++++++++++++
 4 files changed, 50 insertions(+), 35 deletions(-)
 create mode 100644 templates/lib/toast.xsl

diff --git a/filter_inputs.php b/filter_inputs.php
index 3d1fdeb..920db09 100644
--- a/filter_inputs.php
+++ b/filter_inputs.php
@@ -7,7 +7,7 @@ $hostsListRegex          = '/^[\da-zA-Z-.,:\/]+$/';
 $protocolePortsListRegex = '/^(([TU]:)?[0-9\-]+|[a-z\-]+)(,([TU]:)?[0-9\-]+|,[a-z\-]+)*$/';
 $portsListRegex          = '/^([0-9\-]+|[a-z\-]+)(,[0-9\-]+|,[a-z\-]+)*$/';
 $tempoRegex              = '/^\d+[smh]?$/';
-$fileNameRegex           = '/^[^<>:"\/|?]+$/';
+$fileNameRegex           = '/^[^<>:\/|?]+$/';
 
 $targets = filter_input(INPUT_GET, 'targets', FILTER_VALIDATE_REGEXP, ['options' => ['regexp' => $targetsListRegex], "flags" => FILTER_NULL_ON_FAILURE]);
 $preset  = filter_input(INPUT_GET, "preset");
diff --git a/index.php b/index.php
index 540e7af..d9a10fd 100755
--- a/index.php
+++ b/index.php
@@ -347,7 +347,7 @@ Exemples: <?= $_SERVER['REMOTE_ADDR']; ?>/24 <?= $_SERVER['SERVER_NAME']; ?> 10.
             <label for="scriptInput">Scripts</label>
             <input id="scriptInput" type="text" name="--script" placeholder="script"
               title="<catégories|répertoire|nom|all>" list="scripts" pattern="[a-z][a-z0-9\-\.\/]*"
-              value="<?= htmlentities($options["--script"] ?? "", ENT_QUOTES); ?>">
+              value="<?= $options["--script"] ?? ""; ?>">
           </div>
 
           <div class="field">
@@ -467,7 +467,7 @@ foreach (scandir($SCANSDIR) as $filename) {
         <label for="saveAsInput">Enregistrer sous le nom</label>
         <input id="saveAsInput" type="text" name="saveAs" placeholder="Réseau local" pattern='[^&lt;&gt;:&quot;\\\/\|@?]+'
           title="Caractères interdits :  &lt;&gt;:&quot;\/|@?"
-          value="<?= htmlentities($options["saveAs"] ?? "", ENT_QUOTES); ?>">
+          value="<?= $options["saveAs"] ?? ""; ?>">
       </div>
 
       <button type="submit" class="ui teal submit button">Démarrer</button>
@@ -484,7 +484,7 @@ if (!file_exists($SCANSDIR)) {
 foreach (scandir($SCANSDIR) as $filename) {
   if (substr($filename, -4) == '.xml') {
     $name = str_replace('!', '/', substr_replace($filename, '', -4));
-    echo "<a class='item' href='".htmlentities("$SCANSDIR/$filename", ENT_QUOTES)."'>$name</a>\n";
+    echo "<a class='item' href='$SCANSDIR/".rawurlencode($filename)."'>$name</a>\n";
   }
 }
 ?>
diff --git a/templates/hostsTable.xsl b/templates/hostsTable.xsl
index 4ad96f1..c9d69db 100755
--- a/templates/hostsTable.xsl
+++ b/templates/hostsTable.xsl
@@ -6,6 +6,7 @@
 
     <xsl:import href="lib/parseCommand.xsl"/>
     <xsl:import href="lib/serviceLabel.xsl"/>
+    <xsl:import href="lib/toast.xsl"/>
 
     <xsl:output method="html" encoding="UTF-8"/>
     <xsl:output indent="yes"/>
@@ -162,37 +163,9 @@ table.order([1, 'asc']).draw()
 
 $('.ui.dropdown').dropdown()
 
-<xsl:if test="runstats/finished/@summary">
-$.toast({
-    title      : '<xsl:value-of select="runstats/finished/@exit"/>',
-    message    : '<xsl:value-of select="runstats/finished/@summary"/>',
-    showIcon   : 'satellite dish',
-    displayTime: 0,
-    closeIcon  : true,
-    position   : 'bottom right',
-})
-</xsl:if>
-<xsl:if test="runstats/finished/@errormsg">
-$.toast({
-    title      : '<xsl:value-of select="runstats/finished/@exit"/>',
-    message    : '<xsl:value-of select="runstats/finished/@errormsg"/>',
-    showIcon   : 'exclamation triangle',
-    class      : 'error',
-    displayTime: 0,
-    closeIcon  : true,
-    position   : 'bottom right',
-})
-</xsl:if>
-<xsl:if test="$init">
-$.toast({
-    message    : 'Comparaison avec les résultats du <xsl:value-of select="$init/runstats/finished/@timestr"/>',
-    class      : 'info',
-    showIcon   : 'calendar',
-    displayTime: 0,
-    closeIcon  : true,
-    position   : 'bottom right',
-})
-</xsl:if>
+<xsl:apply-templates select="runstats">
+    <xsl:with-param name="init" select="$init"/>
+</xsl:apply-templates>
 
 hiddenButton.onclick = function(event) {
     if (lanScanForm.checkValidity()) {
diff --git a/templates/lib/toast.xsl b/templates/lib/toast.xsl
new file mode 100644
index 0000000..966a69d
--- /dev/null
+++ b/templates/lib/toast.xsl
@@ -0,0 +1,42 @@
+<?xml version="1.0" encoding="utf-8"?>
+<xsl:stylesheet
+    xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+    xmlns:xs="http://www.w3.org/2001/XMLSchema"
+    version="1.1">
+
+    <xsl:template match="runstats">
+        <xsl:param name="init"/>
+        <xsl:if test="finished/@summary">
+$.toast({
+    title      : '<xsl:value-of select="finished/@exit"/>',
+    message    : '<xsl:value-of select="finished/@summary"/>',
+    showIcon   : 'satellite dish',
+    displayTime: 0,
+    closeIcon  : true,
+    position   : 'bottom right',
+})
+        </xsl:if>
+        <xsl:if test="finished/@errormsg">
+$.toast({
+    title      : '<xsl:value-of select="finished/@exit"/>',
+    message    : '<xsl:value-of select="finished/@errormsg"/>',
+    showIcon   : 'exclamation triangle',
+    class      : 'error',
+    displayTime: 0,
+    closeIcon  : true,
+    position   : 'bottom right',
+})
+        </xsl:if>
+        <xsl:if test="$init/runstats/finished">
+$.toast({
+    message    : 'Comparaison avec les résultats du <xsl:value-of select="$init/runstats/finished/@timestr"/>',
+    class      : 'info',
+    showIcon   : 'calendar',
+    displayTime: 0,
+    closeIcon  : true,
+    position   : 'bottom right',
+})
+        </xsl:if>
+    </xsl:template>
+
+</xsl:stylesheet>
\ No newline at end of file