From 90bba73aac47d8cd223c9dd92580a7c44f004180 Mon Sep 17 00:00:00 2001
From: Marcus Hill <bcf8c9f2@opayq.com>
Date: Sat, 11 Mar 2023 19:55:38 +0000
Subject: [PATCH] Documents

- Properly escape HTML in the edit modal
- Tidy
---
 client_document_details.php             | 20 +++++++++-----------
 client_document_edit_modal.php          |  2 +-
 client_document_template_details.php    | 12 +++++-------
 client_document_template_edit_modal.php |  2 +-
 4 files changed, 16 insertions(+), 20 deletions(-)

diff --git a/client_document_details.php b/client_document_details.php
index 254627bb..d329bd87 100644
--- a/client_document_details.php
+++ b/client_document_details.php
@@ -1,6 +1,6 @@
-<?php require_once("inc_all_client.php"); ?>
+<?php
 
-<?php 
+require_once("inc_all_client.php");
 
 if (isset($_GET['document_id'])) {
 	$document_id = intval($_GET['document_id']);
@@ -42,7 +42,7 @@ $document_folder_id = intval($row['document_folder_id']);
 </ol>
 
 <div class="row">
-	
+
   <div class="col-md-9">
 		<div class="card">
 		  <div class="card-body">
@@ -61,7 +61,7 @@ $document_folder_id = intval($row['document_folder_id']);
         <button type="button" class="btn btn-secondary" data-toggle="modal" data-target="#editDocumentModal">
           <i class="fas fa-fw fa-copy mr-2"></i>Copy
         </button>
-        <button type="button" class="btn btn-secondary" data-toggle="modal" data-target="#shareModal" 
+        <button type="button" class="btn btn-secondary" data-toggle="modal" data-target="#shareModal"
           onclick="populateShareModal(<?php echo "$client_id, 'Document', $document_id"; ?>)">
           <i class="fas fa-fw fa-share mr-2"></i>Share
         </button>
@@ -72,7 +72,7 @@ $document_folder_id = intval($row['document_folder_id']);
         <h6><i class="fas fa-fw fa-laptop mr-2"></i>Assets</h6>
         <h6><i class="fas fa-fw fa-cube mr-2"></i>Software</h6>
         <h6><i class="fas fa-fw fa-building mr-2"></i>Vendors</h6>
-        
+
       </div>
     </div>
 
@@ -80,11 +80,9 @@ $document_folder_id = intval($row['document_folder_id']);
 
 </div>
 
-<?php 
+<?php
 
-include("client_document_edit_modal.php");
-include("share_modal.php"); 
+require_once("client_document_edit_modal.php");
+require_once("share_modal.php");
 
-?>
-
-<?php include("footer.php"); ?>
+require_once("footer.php");
diff --git a/client_document_edit_modal.php b/client_document_edit_modal.php
index 3abec2ba..3c0d969a 100644
--- a/client_document_edit_modal.php
+++ b/client_document_edit_modal.php
@@ -17,7 +17,7 @@
                     </div>
 
                     <div class="form-group">
-                        <textarea class="form-control summernote" name="content"><?php echo $document_content; ?></textarea>
+                        <textarea class="form-control summernote" name="content"><?php echo htmlentities($document_content); ?></textarea>
                     </div>
 
                     <div class="form-group">
diff --git a/client_document_template_details.php b/client_document_template_details.php
index 53d09c55..f4f90bf2 100644
--- a/client_document_template_details.php
+++ b/client_document_template_details.php
@@ -1,6 +1,6 @@
-<?php require_once("inc_all_client.php"); ?>
+<?php
 
-<?php 
+require_once("inc_all_client.php");
 
 
 if (isset($_GET['document_id'])) {
@@ -58,10 +58,8 @@ $document_updated_at = htmlentities($row['document_updated_at']);
   </div>
 </div>
 
-<?php 
+<?php
 
-include("client_document_template_edit_modal.php");
+require_once("client_document_template_edit_modal.php");
 
-?>
-
-<?php include("footer.php"); ?>
+require_once("footer.php");
diff --git a/client_document_template_edit_modal.php b/client_document_template_edit_modal.php
index b5fd252c..2ce6a87c 100644
--- a/client_document_template_edit_modal.php
+++ b/client_document_template_edit_modal.php
@@ -16,7 +16,7 @@
                     </div>
 
                     <div class="form-group">
-                        <textarea class="form-control summernote" name="content"><?php echo $document_content; ?></textarea>
+                        <textarea class="form-control summernote" name="content"><?php echo htmlentities($document_content); ?></textarea>
                     </div>
 
                 </div>