From cbf9b3a2772c7ec14c3323a529e89caa628ee523 Mon Sep 17 00:00:00 2001
From: Alexander Makarov <sam@rmcreative.ru>
Date: Fri, 19 Dec 2014 22:15:09 +0300
Subject: [PATCH] Fixed potential security issues

---
 src/www/themes/oldpiratebay/views/layouts/head.php    | 2 +-
 src/www/themes/oldpiratebay/views/main/categories.php | 4 ++--
 src/www/themes/oldpiratebay/views/main/index.php      | 2 +-
 src/www/themes/oldpiratebay/views/main/view.php       | 6 +++---
 4 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/src/www/themes/oldpiratebay/views/layouts/head.php b/src/www/themes/oldpiratebay/views/layouts/head.php
index 7d669a3..a562746 100644
--- a/src/www/themes/oldpiratebay/views/layouts/head.php
+++ b/src/www/themes/oldpiratebay/views/layouts/head.php
@@ -2,7 +2,7 @@
 <html lang="en">
 <head>
     <meta charset="utf-8">
-    <title><?= $this->pageTitle; ?></title>
+    <title><?= CHtml::encode($this->pageTitle); ?></title>
     <meta name="description" content="Download music, movies, games, software and much more. The Pirate Bay is the world's largest bittorrent tracker.">
     <meta name="keywords" content="mp3, avi, bittorrent, piratebay, pirate bay, proxy, torrent, torrents, movies, music, games, applications, apps, download, upload, share, kopimi, magnets, magnet">
     <!--[if lt IE 9]>
diff --git a/src/www/themes/oldpiratebay/views/main/categories.php b/src/www/themes/oldpiratebay/views/main/categories.php
index 3b2507d..dcc3baa 100644
--- a/src/www/themes/oldpiratebay/views/main/categories.php
+++ b/src/www/themes/oldpiratebay/views/main/categories.php
@@ -1,10 +1,10 @@
 <div class="browse-cats short-query">
     <?php foreach ($tags as $tag) {
-        $tagLower = mb_strtolower($tag);
+        $tagLower = mb_strtolower($tag, Yii::app()->charset);
         $tagId = array_search($tag, LCategory::$categoriesTags);
     ?>
     <div class="bg-white mb p">
-        <h3 class="mt0"><a href="<?= $this->createUrl('main/search', array('iht' => $tagId, 'age' => 0)); ?>"><?= $tag; ?> Torrents</a></h3>
+        <h3 class="mt0"><a href="<?= $this->createUrl('main/search', array('iht' => $tagId, 'age' => 0)); ?>"><?= CHtml::encode($tag); ?> Torrents</a></h3>
         <small>
             <a href="<?= $this->createUrl('main/search', array('iht' => $tagId, 'ihs' => 1, 'age' => 1)); ?>">For last day only</a>
         </small>
diff --git a/src/www/themes/oldpiratebay/views/main/index.php b/src/www/themes/oldpiratebay/views/main/index.php
index 0f96125..9a7e006 100644
--- a/src/www/themes/oldpiratebay/views/main/index.php
+++ b/src/www/themes/oldpiratebay/views/main/index.php
@@ -18,7 +18,7 @@
 
                 $tags = LCategory::$categoriesTags;
                 foreach($tags as $tagId => $tag) { ?>
-                    <label title="<?=$tag;?>"><input name="iht" type="checkbox" value="<?=$tagId;?>"><?= $tag; ?></label>
+                    <label title="<?= CHtml::encode($tag);?>"><input name="iht" type="checkbox" value="<?=$tagId;?>"><?= CHtml::encode($tag); ?></label>
                 <?php
                 }
                 ?>
diff --git a/src/www/themes/oldpiratebay/views/main/view.php b/src/www/themes/oldpiratebay/views/main/view.php
index 2b081df..ee9dbc3 100644
--- a/src/www/themes/oldpiratebay/views/main/view.php
+++ b/src/www/themes/oldpiratebay/views/main/view.php
@@ -1,12 +1,12 @@
 <div id="detailsouterframe">
 
     <div id="detailsframe">
-        <div id="title"><a href="<?= $torrent->getUrl(); ?>" class="link-textcolor vm"><?= $torrent->name; ?> torrent</a></div>
+        <div id="title"><a href="<?= $torrent->getUrl(); ?>" class="link-textcolor vm"><?= CHtml::encode($torrent->name); ?> torrent</a></div>
 
         <div id="details">
             <dl class="col1">
                 <dt>Type:</dt>
-                <dd><a href="<?= $this->createUrl('main/search', array('iht' => $torrent->getCategoryTagId(), 'age' => 0)); ?>"><?= ucfirst($torrent->getCategoryTag()); ?></a></dd>
+                <dd><a href="<?= $this->createUrl('main/search', array('iht' => $torrent->getCategoryTagId(), 'age' => 0)); ?>"><?= CHtml::encode(ucfirst($torrent->getCategoryTag())); ?></a></dd>
 
                 <dt>Files:</dt>
                 <dd><?= $torrent->files_count ?: "N/A" ; ?></dd>
@@ -21,7 +21,7 @@
                 <dd><?= number_format($torrent->leechers, 0, '.', ' '); ?></dd>
 
                 <br>
-                <dt>Info Hash:</dt><dd><?= $torrent->hash; ?></dd>
+                <dt>Info Hash:</dt><dd><?= CHtml::encode($torrent->hash); ?></dd>
             </dl>
 
             <br><br>
