Fixed HTML encoding problem.

3 files changed, 20 insertions, 57 deletions

diff --git a/framework/Web/THttpRequest.php b/framework/Web/THttpRequest.php
index d42035df..a6fcdf55 100644
--- a/framework/Web/THttpRequest.php
+++ b/framework/Web/THttpRequest.php
@@ -335,21 +335,23 @@ class THttpRequest extends TModule
 	 * @param string service ID

 	 * @param string service parameter

 	 * @param array GET parameters, null if not needed

+	 * @param boolean whether to encode the ampersand in URL, defaults to false.

 	 * @return string URL

 	 */

-	public function constructUrl($serviceID,$serviceParam,$getItems=null)

+	public function constructUrl($serviceID,$serviceParam,$getItems=null,$encodeAmpersand=false)

 	{

 		$url=$this->getApplicationPath();

 		$url.='?'.$serviceID.'=';

 		if(!empty($serviceParam))

 			$url.=$serviceParam;

+		$amp=$encodeAmpersand?'&':'&';

 		if(is_array($getItems) || $getItems instanceof Traversable)

 		{

 			foreach($getItems as $name=>$value)

-				$url.='&'.urlencode($name).'='.urlencode($value);

+				$url.=$amp.urlencode($name).'='.urlencode($value);

 		}

 		if(defined('SID') && SID != '')

-			$url.='&'.SID;

+			$url.=$amp.SID;

 		return $url;

 	}

 

diff --git a/framework/Web/UI/THtmlWriter.php b/framework/Web/UI/THtmlWriter.php
index 2b2bbd4f..d9c0732b 100644
--- a/framework/Web/UI/THtmlWriter.php
+++ b/framework/Web/UI/THtmlWriter.php
@@ -113,61 +113,22 @@ class THtmlWriter extends TComponent implements ITextWriter
 	private static $_attrEncode=array(

 		'abbr'=>true,

 		'accesskey'=>true,

-		'align'=>false,

 		'alt'=>true,

-		'autocomplete'=>false,

 		'axis'=>true,

 		'background'=>true,

-		'bgcolor'=>false,

-		'border'=>false,

-		'bordercolor'=>false,

-		'cellpadding'=>false,

-		'cellspacing'=>false,

-		'checked'=>false,

 		'class'=>true,

-		'cols'=>false,

-		'colspan'=>false,

 		'content'=>true,

-		'coords'=>false,

-		'dir'=>false,

-		'disabled'=>false,

-		'for'=>false,

 		'headers'=>true,

-		'height'=>false,

 		'href'=>true,

-		'id'=>false,

 		'longdesc'=>true,

-		'maxlength'=>false,

-		'multiple'=>false,

-		'name'=>false,

-		'nowrap'=>false,

 		'onclick'=>true,

 		'onchange'=>true,

-		'readonly'=>false,

-		'rel'=>false,

-		'rows'=>false,

-		'rowspan'=>false,

-		'rules'=>false,

-		'scope'=>false,

-		'selected'=>false,

-		'shape'=>false,

-		'size'=>false,

 		'src'=>true,

-		'style'=>false,

-		'tabindex'=>false,

-		'target'=>false,

 		'title'=>true,

-		'type'=>false,

-		'usemap'=>false,

-		'valign'=>false,

-		'value'=>true,

-		'vcard_name'=>false,

-		'width'=>false,

-		'wrap'=>false

+		'value'=>true

 	);

 	private static $_styleEncode=array(

 		'background-image'=>true,

-		'font-family'=>false,

 		'list-style-image'=>true

 	);

 	private $_attributes=array();

@@ -198,10 +159,7 @@ class THtmlWriter extends TComponent implements ITextWriter
 

 	public function addStyleAttribute($name,$value)

 	{

-		if(isset(self::$_styleEncode[$name]))

-			$this->_styles[$name]=THttpUtility::htmlEncode($value);

-		else

-			$this->_styles[$name]=$value;

+		$this->_styles[$name]=isset(self::$_styleEncode[$name])?THttpUtility::htmlEncode($value):$value;

 	}

 

 	public function flush()

diff --git a/framework/Web/UI/TTemplateManager.php b/framework/Web/UI/TTemplateManager.php
index 7aa6f3b0..21a01b25 100644
--- a/framework/Web/UI/TTemplateManager.php
+++ b/framework/Web/UI/TTemplateManager.php
@@ -317,6 +317,7 @@ class TTemplate extends TComponent implements ITemplate
 	 */

 	protected function configureEvent($component,$name,$value)

 	{

+		$value=THttpUtility::htmlDecode($value);

 		if(strpos($value,'.')===false)

 			$component->attachEventHandler($name,array($component,'TemplateControl.'.$value));

 		else

@@ -336,27 +337,28 @@ class TTemplate extends TComponent implements ITemplate
 			$setter='set'.$name;

 			if(is_array($value))

 			{

+				$v=THttpUtility::htmlDecode($value[1]);

 				switch($value[0])

 				{

 					case self::CONFIG_DATABIND:

-						$component->bindProperty($name,$value[1]);

+						$component->bindProperty($name,$v);

 						break;

 					case self::CONFIG_EXPRESSION:

-						$component->$setter($component->evaluateExpression($value[1]));

+						$component->$setter($component->evaluateExpression($v));

 						break;

 					case self::CONFIG_ASSET:		// asset URL

-						$url=$this->_assetManager->publishFilePath($this->_contextPath.'/'.$value[1]);

+						$url=$this->_assetManager->publishFilePath($this->_contextPath.'/'.$v);

 						$component->$setter($url);

 						break;

 					case self::CONFIG_PARAMETER:		// application parameter

-						$component->$setter(Prado::getApplication()->getParameters()->itemAt($value[1]));

+						$component->$setter(Prado::getApplication()->getParameters()->itemAt($v));

 						break;

 					default:	// an error if reaching here

 						break;

 				}

 			}

 			else

-				$component->$setter($value);

+				$component->$setter(THttpUtility::htmlDecode($value));

 		}

 		else

 			throw new TTemplateRuntimeException('template_property_readonly',get_class($component),$name);

@@ -372,27 +374,28 @@ class TTemplate extends TComponent implements ITemplate
 	{

 		if(is_array($value))

 		{

+			$v=THttpUtility::htmlDecode($value[1]);

 			switch($value[0])

 			{

 				case self::CONFIG_DATABIND:		// databinding

-					$component->bindProperty($name,$value[1]);

+					$component->bindProperty($name,$v);

 					break;

 				case self::CONFIG_EXPRESSION:		// expression

-					$component->setSubProperty($name,$component->evaluateExpression($value[1]));

+					$component->setSubProperty($name,$component->evaluateExpression($v));

 					break;

 				case self::CONFIG_ASSET:		// asset URL

-					$url=$this->_assetManager->publishFilePath($this->_contextPath.'/'.$value[1]);

+					$url=$this->_assetManager->publishFilePath($this->_contextPath.'/'.$v);

 					$component->setSubProperty($name,$url);

 					break;

 				case self::CONFIG_PARAMETER:		// application parameter

-					$component->setSubProperty($name,Prado::getApplication()->getParameters()->itemAt($value[1]));

+					$component->setSubProperty($name,Prado::getApplication()->getParameters()->itemAt($v));

 					break;

 				default:	// an error if reaching here

 					break;

 			}

 		}

 		else

-			$component->setSubProperty($name,$value);

+			$component->setSubProperty($name,THttpUtility::htmlDecode($value));

 	}

 

 	/**