fix XSS

[freeside.git] / FS / FS / UI / Web.pm

diff --git a/FS/FS/UI/Web.pm b/FS/FS/UI/Web.pm
index 029b02c..c2ea0a6 100644 (file)
--- a/FS/FS/UI/Web.pm
+++ b/FS/FS/UI/Web.pm
@@ -3,7 +3,8 @@ package FS::UI::Web;
 use strict;
 use vars qw($DEBUG @ISA @EXPORT_OK $me);
 use Exporter;
-use Carp qw( confess );;
+use Carp qw( confess );
+use HTML::Entities;
 use FS::Conf;
 use FS::Misc::DateTime qw( parse_datetime );
 use FS::Record qw(dbdef);
@@ -383,7 +384,7 @@ sub cust_fields {
   map { 
     if ( $record->custnum ) {
       warn "  $record -> $_" if $DEBUG > 1;
-      $record->$_(@_);
+      encode_entities( $record->$_(@_) );
     } else {
       warn "  ($record unlinked)" if $DEBUG > 1;
       $seen_unlinked++ ? '' : '(unlinked)';
@@ -484,6 +485,20 @@ sub cust_aligns {
   }
 }
 
+=item is_mobile
+
+Utility function to determine if the client is a mobile browser.
+
+=cut
+
+sub is_mobile {
+  my $ua = $ENV{'HTTP_USER_AGENT'} || '';
+  if ( $ua =~ /(?:hiptop|Blazer|Novarra|Vagabond|SonyEricsson|Symbian|NetFront|UP.Browser|UP.Link|Windows CE|MIDP|J2ME|DoCoMo|J-PHONE|PalmOS|PalmSource|iPhone|iPod|AvantGo|Nokia|Android|WebOS|S60|Opera Mini|Opera Mobi)/io ) {
+    return 1;
+  }
+  return 0;
+}
+    
 ###
 # begin JSRPC code...
 ###
@@ -641,7 +656,9 @@ sub job_status {
   }
 
   #to_json(\@return);  #waiting on deb 5.0 for new JSON.pm?
-  objToJson(\@return);
+  #silence the warning though
+  my $to_json = JSON->can('to_json') || JSON->can('objToJson');
+  &$to_json(\@return);
 
 }