From 2eed9b39c09d6a5e5cbb0c4aea12a4dabeb99e51 Mon Sep 17 00:00:00 2001
From: Mark Schouten <mark@tuxis.nl>
Date: Mon, 26 May 2014 13:45:03 +0200
Subject: [PATCH] Fix escaping. Jtable shows (javascript-escaped) content. No
 other escaping is done on the content-field

For txt-records. First strip quotes surrounding the content and strip from slashes. Then, add slashes and quotes again. This maybe sub-optimal, but works for now.
---
 index.php | 24 +++++++++++++++++++++++-
 zones.php |  9 ++++-----
 2 files changed, 27 insertions(+), 6 deletions(-)

diff --git a/index.php b/index.php
index f8bd216..871834e 100644
--- a/index.php
+++ b/index.php
@@ -124,6 +124,22 @@ if (isset($templatelist)) {
 	<? } ?>
 </div>
 <script type="text/javascript">
+var entityMap = {
+    "&": "&amp;",
+    "<": "&lt;",
+    ">": "&gt;",
+    '"': '&quot;',
+    "'": '&#39;',
+    "/": '&#x2F;'
+};
+
+function escapeHtml(string) {
+    return String(string).replace(/[&<>"'\/]/g, function (s) {
+        return entityMap[s];
+    });
+};
+
+
 $(document).ready(function () {
 	<? if (is_adminuser()) { ?>
 	$('#Users').hide();
@@ -241,7 +257,10 @@ $(document).ready(function () {
 										title: 'Prio'
 									},
 									content: {
-										title: 'Content'
+										title: 'Content',
+                                        display: function (data) {
+                                            return escapeHtml(data.value);
+                                        }
 									},
 									ttl: {
 										title: 'TTL'
@@ -388,6 +407,9 @@ $(document).ready(function () {
 									content: {
 										title: 'Content',
 										create: true
+                                        display: function (data) {
+                                            return escapeHtml(data.value);
+                                        }
 									},
 									ttl: {
 										title: 'TTL',
diff --git a/zones.php b/zones.php
index f716b95..7458962 100644
--- a/zones.php
+++ b/zones.php
@@ -58,7 +58,9 @@ function _create_record($name, $records, $input, $zoneurl) {
     }
 
     if (preg_match('/^TXT$/', $input['type'])) {
-        $content = addslashes($input['content']);
+        $content = stripslashes($input['content']);
+        $content = preg_replace('/(^"|"$)/', '', $content);
+        $content = addslashes($content);
         $content = '"'.$content.'"';
     }
 
@@ -217,7 +219,6 @@ if ($action == "list" or $action== "listslaves") {
     foreach ($rows['records'] as $idx => $record) {
         $rows['records'][$idx]['id'] = json_encode($record);
         $rows['records'][$idx]['name'] = htmlspecialchars($record['name']);
-        $rows['records'][$idx]['content'] = htmlspecialchars($record['content']);
         if ($record['type'] == 'SOA') { array_push($soa, $rows['records'][$idx]); }
         elseif ($record['type'] == 'NS') { array_push($ns, $rows['records'][$idx]); }
         elseif ($record['type'] == 'MX') { array_push($mx, $rows['records'][$idx]); }
@@ -241,9 +242,7 @@ if ($action == "list" or $action== "listslaves") {
     }
 
     $records =_create_record($name, $records, $_POST, $_GET['zoneurl']);
-    $ret = $records[sizeof($records)-1];
-    $ret['content'] = htmlspecialchars($ret['content']);
-    _jtable_respond($ret, 'single');
+    _jtable_respond($records[sizeof($records)-1], 'single');
 } elseif ($action == "deleterecord") {
     $todel = json_decode($_POST['id'], 1);
     $records = getrecords_by_name_type($_GET['zoneurl'], $todel['name'], $todel['type']);