From a23a41f0216601d27b7ccd1336ec5cbe0f61703d Mon Sep 17 00:00:00 2001
From: Xkeeper <xkeeper@gmail.com>
Date: Sun, 4 Nov 2018 14:08:00 -0800
Subject: [PATCH] [fix #18] poll creation/display now consistent

---
 newthread.php | 22 ++++++++++++++++------
 thread.php    |  4 ++--
 2 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/newthread.php b/newthread.php
index 74156b4..0247dc9 100644
--- a/newthread.php
+++ b/newthread.php
@@ -68,8 +68,11 @@
 		<br>$radio=iconid value=-1 $checked>&nbsp;None&nbsp; &nbsp; &nbsp;
 		Custom: $inpt=custposticon SIZE=40 MAXLENGTH=100 VALUE=\"". stripslashes($custposticon) ."\">
 	";
+<<<<<<< Updated upstream
 	$subject=htmlspecialchars($subject);
 	$question=htmlspecialchars($question);
+=======
+>>>>>>> Stashed changes
 
 	if ($nosmilies)	$nosmilieschk	= " checked";
 	if ($nohtml)	$nohtmlchk	= " checked";
@@ -94,13 +97,13 @@
 		<!-- </FORM> -->
 	":"
 		<tr>$tccell1><b>Poll icon:</td>	$tccell2l colspan=2>$posticonlist</td></tr>
-		<tr>$tccell1><b>Poll title:</td>	$tccell2l colspan=2>$inpt=subject SIZE=40 MAXLENGTH=100 VALUE=\"". stripslashes($subject) ."\"></td></tr>
-		<tr>$tccell1><b>Question:</td>	$tccell2l colspan=2>$inpt=question SIZE=60 MAXLENGTH=255 VALUE=\"". stripslashes($question) ."\"></td></tr>
-		<tr>$tccell1><b>Briefing:</td>	$tccell2l colspan=2>$txta=briefing ROWS=2 COLS=$numcols style=\"resize:vertical;\">". stripslashes($briefing) ."</TEXTAREA></td></tr>
+		<tr>$tccell1><b>Poll title:</td>	$tccell2l colspan=2>$inpt=subject SIZE=40 MAXLENGTH=100 VALUE=\"". htmlspecialchars(stripslashes($subject)) ."\"></td></tr>
+		<tr>$tccell1><b>Question:</td>	$tccell2l colspan=2>$inpt=question SIZE=60 MAXLENGTH=255 VALUE=\"". htmlspecialchars(stripslashes($question)) ."\"></td></tr>
+		<tr>$tccell1><b>Briefing:</td>	$tccell2l colspan=2>$txta=briefing ROWS=2 COLS=$numcols style=\"resize:vertical;\">". htmlspecialchars(stripslashes($briefing)) ."</TEXTAREA></td></tr>
 		<tr>$tccell1><b>Multi-voting:</td>$tccell2l colspan=2>$radio=mltvote value=0 $checked0> Disabled &nbsp $radio=mltvote value=1 $checked1> Enabled</td></tr>
 		<tr>$tccell1><b>Choices:</td>	$tccell2l colspan=2>$choices</td></tr>
 		<tr>$tccell1><b>Post:</td>$tccell2l width=800px valign=top>".replytoolbar(2)."
-		$txta=message ROWS=21 COLS=$numcols style=\"width: 100%; max-width: 800px; resize:vertical;\">". stripslashes(htmlspecialchars($message)) ."</TEXTAREA></td>
+		$txta=message ROWS=21 COLS=$numcols style=\"width: 100%; max-width: 800px; resize:vertical;\">". htmlspecialchars(stripslashes($message)) ."</TEXTAREA></td>
 		$tccell2l width=*>".moodlist($moodid)."</td></tr>
 
 		<tr>
@@ -275,16 +278,23 @@
 						";
 					}
 					$mlt=($mltvote?'enabled':'disabled');
+					$subject = htmlspecialchars(stripslashes($subject));
+					$question = htmlspecialchars(stripslashes($question));
+					$briefing = htmlspecialchars(stripslashes($briefing));
+
 					$pollpreview="
-						<td colspan=3 class='tbl tdbgc center font'><b>$question<tr>
-						$tccell2ls colspan=3>$briefing<tr>
+						<td colspan=3 class='tbl tdbgc center font'><b>". $question ."<tr>
+						$tccell2ls colspan=3>". $briefing ."<tr>
 						$pchoices
 						$tccell2ls colspan=3>Multi-voting is $mlt.
 						$tblend<br>$tblstart
 					";
+<<<<<<< Updated upstream
 					$subject = htmlspecialchars(stripslashes($subject));
 					$question = htmlspecialchars(stripslashes($question));
 					$briefing = htmlspecialchars(stripslashes($briefing));
+=======
+>>>>>>> Stashed changes
 				}
 				loadtlayout();
 				$ppost=$user;
diff --git a/thread.php b/thread.php
index 24d3f13..12eed21 100644
--- a/thread.php
+++ b/thread.php
@@ -292,7 +292,7 @@
 				$link = "<a href='?id={$id}&dat={$confirm}&{$linkact}vote=$pollc[id]'>";
 
 			$choices	.= "<tr>
-				$tccell1l width=20%>$dot$link".($pollc['choice'])."</a></td>
+				$tccell1l width=20%>$dot$link".htmlspecialchars($pollc['choice'])."</a></td>
 				$tccell2l width=60%>$barpart</td>
 				$tccell1 width=20%>".($poll['doublevote'] ? "$pct% of users, $votes ($pct2%)" : "$pct%, $votes")."</td>
 				</tr>";
@@ -308,7 +308,7 @@
 
 		$polltbl = "$tblstart
 			<tr>$tccellc colspan=3><b>".htmlspecialchars($poll['question'])."</td></tr>
-			<tr>$tccell2ls colspan=3>".nl2br(dofilters($poll['briefing']))."</td></tr>
+			<tr>$tccell2ls colspan=3>".nl2br(htmlspecialchars(dofilters($poll['briefing'])))."</td></tr>
 			$choices
 			<tr>$tccell2l colspan=3>$smallfont $polltext $tvotes_u user$s_have voted. $polledit</td></tr>
 			$tblend<br>