fix(security): systematic output escaping with e() and video-card partial
This commit is contained in:
@@ -108,7 +108,7 @@ if (defined('CASTOPOD_ENABLED') && CASTOPOD_ENABLED && defined('CASTOPOD_URL') &
|
||||
|
||||
<!-- ------ Script Plausible ------ -->
|
||||
|
||||
<!-- <script defer data-domain="<?php echo $_SERVER['HTTP_HOST'] ?>" src="https://plausible.io/js/script.hash.outbound-links.pageview-props.tagged-events.js"></script> -->
|
||||
<!-- <script defer data-domain="<?php echo htmlspecialchars(APP_HOST_NAME); ?>" src="https://plausible.io/js/script.hash.outbound-links.pageview-props.tagged-events.js"></script> -->
|
||||
<!-- <script>window.plausible = window.plausible || function() { (window.plausible.q = window.plausible.q || []).push(arguments) }</script> -->
|
||||
|
||||
<!-- ------ Script Plausible ------ -->
|
||||
@@ -421,9 +421,9 @@ if (defined('CASTOPOD_ENABLED') && CASTOPOD_ENABLED && defined('CASTOPOD_URL') &
|
||||
foreach ($shorts as $video):
|
||||
?>
|
||||
<div class="carousel-item">
|
||||
<article class="video-card short-card" data-video-id="<?php echo $video['id']; ?>">
|
||||
<article class="video-card short-card" data-video-id="<?php echo e($video['id']); ?>">
|
||||
<div class="video-thumbnail short-thumbnail">
|
||||
<img src="<?php echo $video['thumbnail']; ?>" alt="Miniature de la vidéo: <?php echo htmlspecialchars($video['title']); ?>">
|
||||
<img src="<?php echo e($video['thumbnail']); ?>" alt="Miniature de la vidéo: <?php echo htmlspecialchars($video['title']); ?>">
|
||||
<div class="video-duration" aria-label="Durée: <?php echo formatDuration($video['duration']); ?>">
|
||||
<?php echo formatDuration($video['duration']); ?>
|
||||
</div>
|
||||
@@ -474,38 +474,7 @@ if (defined('CASTOPOD_ENABLED') && CASTOPOD_ENABLED && defined('CASTOPOD_URL') &
|
||||
echo '<div class="no-results">Aucune vidéo disponible pour le moment</div>';
|
||||
} else {
|
||||
foreach ($recentVideos as $video):
|
||||
?>
|
||||
<article class="video-card" data-video-id="<?php echo $video['id']; ?>">
|
||||
<div class="video-thumbnail">
|
||||
<img src="<?php echo $video['thumbnail']; ?>" alt="Miniature de la vidéo: <?php echo htmlspecialchars($video['title']); ?>">
|
||||
<div class="video-play-icon" aria-hidden="true">
|
||||
<i class="fas fa-play-circle"></i>
|
||||
</div>
|
||||
<div class="video-duration" aria-label="Durée: <?php echo formatDuration($video['duration']); ?>">
|
||||
<?php echo formatDuration($video['duration']); ?>
|
||||
</div>
|
||||
</div>
|
||||
<div class="video-info">
|
||||
<h3 class="video-title"><?php echo htmlspecialchars($video['title']); ?></h3>
|
||||
<div class="video-channel">
|
||||
<?php if (strpos($video['channelAvatar'], 'default-avatar.png') !== false || empty($video['channelAvatar'])): ?>
|
||||
<div class="channel-avatar-placeholder">
|
||||
<i class="fas fa-user-circle"></i>
|
||||
</div>
|
||||
<?php else: ?>
|
||||
<img src="<?php echo $video['channelAvatar']; ?>" alt="<?php echo $video['channel']; ?>" class="channel-avatar">
|
||||
<?php endif; ?>
|
||||
<span class="channel-name"><?php echo $video['channel']; ?></span>
|
||||
</div>
|
||||
<div class="video-metadata">
|
||||
<?php if (defined('SHOW_VIDEO_VIEWS') && SHOW_VIDEO_VIEWS): ?>
|
||||
<span class="video-views"><i class="fas fa-eye"></i> <?php echo formatViewCount($video['views']); ?> vues</span>
|
||||
<?php endif; ?>
|
||||
<span class="video-date"><i class="far fa-calendar-alt"></i> <?php echo formatDate($video['date']); ?></span>
|
||||
</div>
|
||||
</div>
|
||||
</article>
|
||||
<?php
|
||||
echo renderVideoCard($video);
|
||||
endforeach;
|
||||
}
|
||||
?>
|
||||
@@ -536,36 +505,7 @@ if (defined('CASTOPOD_ENABLED') && CASTOPOD_ENABLED && defined('CASTOPOD_URL') &
|
||||
echo '<div class="no-results">Aucune vidéo disponible pour le moment</div>';
|
||||
} else {
|
||||
foreach ($trendingVideos as $video):
|
||||
?>
|
||||
<article class="video-card" data-video-id="<?php echo $video['id']; ?>">
|
||||
<div class="video-thumbnail">
|
||||
<img src="<?php echo htmlspecialchars($video['thumbnail']); ?>" alt="<?php echo htmlspecialchars($video['title']); ?>">
|
||||
<div class="video-play-icon">
|
||||
<i class="fas fa-play-circle"></i>
|
||||
</div>
|
||||
<div class="video-duration"><?php echo formatDuration($video['duration']); ?></div>
|
||||
</div>
|
||||
<div class="video-info">
|
||||
<h3 class="video-title"><?php echo $video['title']; ?></h3>
|
||||
<div class="video-channel">
|
||||
<?php if (strpos($video['channelAvatar'], 'default-avatar.png') !== false || empty($video['channelAvatar'])): ?>
|
||||
<div class="channel-avatar-placeholder">
|
||||
<i class="fas fa-user-circle"></i>
|
||||
</div>
|
||||
<?php else: ?>
|
||||
<img src="<?php echo $video['channelAvatar']; ?>" alt="<?php echo $video['channel']; ?>" class="channel-avatar">
|
||||
<?php endif; ?>
|
||||
<span class="channel-name"><?php echo $video['channel']; ?></span>
|
||||
</div>
|
||||
<div class="video-metadata">
|
||||
<?php if (defined('SHOW_VIDEO_VIEWS') && SHOW_VIDEO_VIEWS): ?>
|
||||
<span class="video-views"><i class="fas fa-eye"></i> <?php echo formatViewCount($video['views']); ?> vues</span>
|
||||
<?php endif; ?>
|
||||
<span class="video-date"><i class="far fa-calendar-alt"></i> <?php echo formatDate($video['date']); ?></span>
|
||||
</div>
|
||||
</div>
|
||||
</article>
|
||||
<?php
|
||||
echo renderVideoCard($video);
|
||||
endforeach;
|
||||
}
|
||||
?>
|
||||
@@ -586,45 +526,18 @@ if (defined('CASTOPOD_ENABLED') && CASTOPOD_ENABLED && defined('CASTOPOD_URL') &
|
||||
foreach ($displayCategories as $category):
|
||||
if (!empty($category['videos'])):
|
||||
?>
|
||||
<!-- Section Catégorie: <?php echo $category['name']; ?> -->
|
||||
<section class="video-section" data-category-id="<?php echo $category['id']; ?>" aria-labelledby="category-heading-<?php echo $category['id']; ?>">
|
||||
<!-- Section Catégorie: <?php echo e($category['name']); ?> -->
|
||||
<section class="video-section" data-category-id="<?php echo e($category['id']); ?>" aria-labelledby="category-heading-<?php echo e($category['id']); ?>">
|
||||
<header class="section-header">
|
||||
<div class="section-logo">
|
||||
<img src="img/logo.png" alt="" aria-hidden="true">
|
||||
</div>
|
||||
<h2 id="category-heading-<?php echo $category['id']; ?>" class="section-title"><?php echo htmlspecialchars($category['name']); ?></h2>
|
||||
<h2 id="category-heading-<?php echo e($category['id']); ?>" class="section-title"><?php echo htmlspecialchars($category['name']); ?></h2>
|
||||
</header>
|
||||
|
||||
<div class="video-grid">
|
||||
<?php foreach ($category['videos'] as $video): ?>
|
||||
<article class="video-card" data-video-id="<?php echo $video['id']; ?>">
|
||||
<div class="video-thumbnail">
|
||||
<img src="<?php echo htmlspecialchars($video['thumbnail']); ?>" alt="<?php echo htmlspecialchars($video['title']); ?>">
|
||||
<div class="video-play-icon">
|
||||
<i class="fas fa-play-circle"></i>
|
||||
</div>
|
||||
<div class="video-duration"><?php echo formatDuration($video['duration']); ?></div>
|
||||
</div>
|
||||
<div class="video-info">
|
||||
<h3 class="video-title"><?php echo $video['title']; ?></h3>
|
||||
<div class="video-channel">
|
||||
<?php if (strpos($video['channelAvatar'], 'default-avatar.png') !== false || empty($video['channelAvatar'])): ?>
|
||||
<div class="channel-avatar-placeholder">
|
||||
<i class="fas fa-user-circle"></i>
|
||||
</div>
|
||||
<?php else: ?>
|
||||
<img src="<?php echo $video['channelAvatar']; ?>" alt="<?php echo $video['channel']; ?>" class="channel-avatar">
|
||||
<?php endif; ?>
|
||||
<span class="channel-name"><?php echo $video['channel']; ?></span>
|
||||
</div>
|
||||
<div class="video-metadata">
|
||||
<?php if (defined('SHOW_VIDEO_VIEWS') && SHOW_VIDEO_VIEWS): ?>
|
||||
<span class="video-views"><i class="fas fa-eye"></i> <?php echo formatViewCount($video['views']); ?> vues</span>
|
||||
<?php endif; ?>
|
||||
<span class="video-date"><i class="far fa-calendar-alt"></i> <?php echo formatDate($video['date']); ?></span>
|
||||
</div>
|
||||
</div>
|
||||
</article>
|
||||
<?php echo renderVideoCard($video); ?>
|
||||
<?php endforeach; ?>
|
||||
</div>
|
||||
|
||||
@@ -707,7 +620,7 @@ if (defined('CASTOPOD_ENABLED') && CASTOPOD_ENABLED && defined('CASTOPOD_URL') &
|
||||
|
||||
// Afficher le bouton d'installation s'il existe
|
||||
if (installButton) {
|
||||
installButton.style.display = 'block';
|
||||
installButton.classList.remove('is-hidden');
|
||||
installButton.addEventListener('click', function() {
|
||||
deferredPrompt.prompt();
|
||||
deferredPrompt.userChoice.then(function(choiceResult) {
|
||||
@@ -715,7 +628,7 @@ if (defined('CASTOPOD_ENABLED') && CASTOPOD_ENABLED && defined('CASTOPOD_URL') &
|
||||
console.log('PWA installée');
|
||||
}
|
||||
deferredPrompt = null;
|
||||
installButton.style.display = 'none';
|
||||
installButton.classList.add('is-hidden');
|
||||
});
|
||||
});
|
||||
}
|
||||
@@ -725,7 +638,7 @@ if (defined('CASTOPOD_ENABLED') && CASTOPOD_ENABLED && defined('CASTOPOD_URL') &
|
||||
window.addEventListener('appinstalled', function() {
|
||||
console.log('PWA installée avec succès');
|
||||
if (installButton) {
|
||||
installButton.style.display = 'none';
|
||||
installButton.classList.add('is-hidden');
|
||||
}
|
||||
});
|
||||
</script>
|
||||
|
||||
Reference in New Issue
Block a user