Better control of xml enconding... still a lot of testing to do though.

1 files changed, 16 insertions, 12 deletions

diff --git a/utils/modules/newsletter.php b/utils/modules/newsletter.php
index 4bba9c6..3ca3f41 100644
--- a/utils/modules/newsletter.php
+++ b/utils/modules/newsletter.php
@@ -3,6 +3,7 @@
 global $UTIL_DIR;
 
 include_once($UTIL_DIR . "/mail.php");
+include_once($UTIL_DIR . "/convert.php");
 
 class Mailinglist extends _Mailinglist {
 	private $file;
@@ -13,15 +14,14 @@ class Mailinglist extends _Mailinglist {
 		$fp = fopen($this->file, "w");
 		fwrite($fp, "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n");
 
-		fwrite($fp, "<mailinglist subj_prefix=\"" . $this->subj_prefix . "\"\n");
-    fwrite($fp, "             sender=\"" . $this->sender . "\"\n");
-    fwrite($fp, "             replyto=\"" . $this->replyto . "\"\n");
-    fwrite($fp, "             unsubscribe_url=\"" . $this->unsubscribe_url . "\">\n");
-    fwrite($fp, "  <footer>" . $this->footer . "</footer>\n");
+		fwrite($fp, "<mailinglist subj_prefix=\"" . xmlenc($this->subj_prefix) . "\"\n");
+    fwrite($fp, "             sender=\"" . xmlenc($this->sender) . "\"\n");
+    fwrite($fp, "             replyto=\"" . xmlenc($this->replyto) . "\"\n");
+    fwrite($fp, "             unsubscribe_url=\"" . xmlenc($this->unsubscribe_url) . "\">\n");
+    fwrite($fp, "  <footer>" .  xmlenc($this->footer) . "</footer>\n");
 		foreach($this->mailinglist as $email) {
-			fwrite($fp, "  <email email=\"" .
-						 htmlspecialchars($email->email, ENT_QUOTES, "UTF-8") . "\"\n");
- 			fwrite($fp, "         timestamp=\"" . $email->timestamp . "\">\n");
+			fwrite($fp, "  <email email=\"" . xmlenc($email->email) . "\"\n");
+ 			fwrite($fp, "         timestamp=\"" . xmlenc($email->timestamp) . "\">\n");
 			fwrite($fp, "  </email>\n");
 		}
 		fwrite($fp, "</mailinglist>\n");
@@ -64,9 +64,11 @@ class Mailinglist extends _Mailinglist {
 		$email = new EMail($emailaddr, time());
 		if($this->add($email)) {
 			$this->write();
-			$str .= "<div class=\"newsletter_message\">The email: " . $emailaddr . " has now been subscribed.</div>";
+			$str .= "<div class=\"newsletter_message\">The email: " .
+        $emailaddr . " has now been subscribed.</div>";
 		} else {
-			$str .= "<div class=\"newsletter_message\">The email: " . $emailaddr . " is already subscribed.</div>";
+			$str .= "<div class=\"newsletter_message\">The email: " .
+        $emailaddr . " is already subscribed.</div>";
 		}
 		return $str;
 	}
@@ -76,9 +78,11 @@ class Mailinglist extends _Mailinglist {
 		$str = "";
 		if($this->remove($emailaddr)) {
 			$this->write();
-			$str .= "<div class=\"newsletter_message\">The email: " . $emailaddr . " has now been unsubscribed.</div>";
+			$str .= "<div class=\"newsletter_message\">The email: " .
+        $emailaddr . " has now been unsubscribed.</div>";
 		} else {
-			$str .= "<div class=\"newsletter_message\">The email: " . $emailaddr . " is not subscribed.</div>";
+			$str .= "<div class=\"newsletter_message\">The email: " .
+        $emailaddr . " is not subscribed.</div>";
 		}
 		return $str;
 	}