Merge pull request #2521 from department-of-veterans-affairs/rc/2024-…

…08-14/Sprint-79-c2 Rc/2024 08 14/sprint 79 c2
department-of-veterans-affairs · Aug 20, 2024 · 5399e9b · 5399e9b
2 parents 836a830 + 8ecafda
commit 5399e9b
Show file tree

Hide file tree

Showing 4 changed files with 15 additions and 8 deletions.
diff --git a/LEAF_Request_Portal/admin/index.php b/LEAF_Request_Portal/admin/index.php
@@ -641,7 +641,7 @@ function hasDevConsoleAccess($login, $oc_db)
 $t_menu->assign('orgchartPath', $site_paths['orgchart_path']);
 $t_menu->assign('name', XSSHelpers::sanitizeHTML($login->getName()));
 $t_menu->assign('siteType', XSSHelpers::xscrub($settings['siteType']));
-$o_menu = $t_menu->fetch('menu.tpl');
+$o_menu = $t_menu->fetch(customTemplate('menu.tpl'));
 $main->assign('menu', $o_menu);
 $tabText = $tabText == '' ? '' : $tabText . '&nbsp;';
 $main->assign('tabText', $tabText);

diff --git a/LEAF_Request_Portal/scripts/automated_email.php b/LEAF_Request_Portal/scripts/automated_email.php
@@ -157,6 +157,7 @@
         $email->setSiteRoot($siteRoot);
         // ive seen examples using the attachApproversAndEmail method and some had smarty vars and some did not.
         $title = strlen($record['title']) > 45 ? substr($record['title'], 0, 42) . '...' : $record['title'];
+        $truncatedTitle = trim(strip_tags(htmlspecialchars_decode($title, ENT_QUOTES | ENT_HTML5 )));
 
         // add in variables for the smarty template
         $pl = (int)$record['daysSince'] > 1 ? 's' : '';
@@ -173,7 +174,7 @@
             "daysSince" => $daysSinceText,      //used in email subject.  retaining variable name for backward compat
             "actualDaysAgo" => $lastActionDays, //customized template backward compat
             "reminderBodyText" => $reminderBodyText,
-            "truncatedTitle" => $title,
+            "truncatedTitle" => $truncatedTitle,
             "fullTitle" => $record['title'],
             "recordID" => $record['recordID'],
             "service" => $record['service'],

diff --git a/LEAF_Request_Portal/sources/Email.php b/LEAF_Request_Portal/sources/Email.php
@@ -612,9 +612,10 @@ function attachApproversAndEmail(int $recordID, int $emailTemplateID, mixed $log
         // Start adding users to email if we have them
         if (count($approvers) > 0) {
             $title = strlen($approvers[0]['title']) > 45 ? substr($approvers[0]['title'], 0, 42) . '...' : $approvers[0]['title'];
+            $truncatedTitle = trim(strip_tags(htmlspecialchars_decode($title, ENT_QUOTES | ENT_HTML5 )));
 
             $this->addSmartyVariables(array(
-                "truncatedTitle" => $title,
+                "truncatedTitle" => $truncatedTitle,
                 "fullTitle" => $approvers[0]['title'],
                 "recordID" => $recordID,
                 "service" => $approvers[0]['service'],
@@ -753,9 +754,10 @@ function attachApproversAndEmail(int $recordID, int $emailTemplateID, mixed $log
             $recordInfo = $this->getRecord($recordID);
 
             $title = strlen($recordInfo[0]['title']) > 45 ? substr($recordInfo[0]['title'], 0, 42) . '...' : $recordInfo[0]['title'];
+            $truncatedTitle = trim(strip_tags(htmlspecialchars_decode($title, ENT_QUOTES | ENT_HTML5 )));
 
             $this->addSmartyVariables(array(
-                "truncatedTitle" => $title,
+                "truncatedTitle" => $truncatedTitle,
                 "fullTitle" => $recordInfo[0]['title'],
                 "recordID" => $recordID,
                 "service" => $recordInfo[0]['service'],
@@ -781,9 +783,10 @@ function attachApproversAndEmail(int $recordID, int $emailTemplateID, mixed $log
             $comment = $comments[0]['comment'] === '' ? '' : 'Reason for cancelling: ' . $comments[0]['comment'] . '<br /><br />';
 
             $title = strlen($recordInfo[0]['title']) > 45 ? substr($recordInfo[0]['title'], 0, 42) . '...' : $recordInfo[0]['title'];
+            $truncatedTitle = trim(strip_tags(htmlspecialchars_decode($title, ENT_QUOTES | ENT_HTML5 )));
 
             $this->addSmartyVariables(array(
-                "truncatedTitle" => $title,
+                "truncatedTitle" => $truncatedTitle,
                 "fullTitle" => $recordInfo[0]['title'],
                 "recordID" => $recordID,
                 "service" => $recordInfo[0]['service'],

diff --git a/LEAF_Request_Portal/sources/FormWorkflow.php b/LEAF_Request_Portal/sources/FormWorkflow.php
@@ -1368,9 +1368,10 @@ public function handleEvents(int $workflowID, int $stepID, string $actionType, ?
 
 
             $title = strlen($record[0]['title']) > 45 ? substr($record[0]['title'], 0, 42) . '...' : $record[0]['title'];
+            $truncatedTitle = trim(strip_tags(htmlspecialchars_decode($title, ENT_QUOTES | ENT_HTML5 )));
 
             $email->addSmartyVariables(array(
-                "truncatedTitle" => $title,
+                "truncatedTitle" => $truncatedTitle,
                 "fullTitle" => $record[0]['title'],
                 "recordID" => $this->recordID,
                 "service" => $record[0]['service'],
@@ -1466,9 +1467,10 @@ public function handleEvents(int $workflowID, int $stepID, string $actionType, ?
                         $email = new Email();
 
                         $title = strlen($requestRecords[0]['title']) > 45 ? substr($requestRecords[0]['title'], 0, 42) . '...' : $requestRecords[0]['title'];
+                        $truncatedTitle = trim(strip_tags(htmlspecialchars_decode($title, ENT_QUOTES | ENT_HTML5 )));
 
                         $email->addSmartyVariables(array(
-                            "truncatedTitle" => $title,
+                            "truncatedTitle" => $truncatedTitle,
                             "fullTitle" => $requestRecords[0]['title'],
                             "recordID" => $this->recordID,
                             "service" => $requestRecords[0]['service'],
@@ -1534,9 +1536,10 @@ public function handleEvents(int $workflowID, int $stepID, string $actionType, ?
                         $email = new Email();
 
                         $title = strlen($requestRecords[0]['title']) > 45 ? substr($requestRecords[0]['title'], 0, 42) . '...' : $requestRecords[0]['title'];
+                        $truncatedTitle = trim(strip_tags(htmlspecialchars_decode($title, ENT_QUOTES | ENT_HTML5 )));
 
                         $email->addSmartyVariables(array(
-                            "truncatedTitle" => $title,
+                            "truncatedTitle" => $truncatedTitle,
                             "fullTitle" => $requestRecords[0]['title'],
                             "recordID" => $this->recordID,
                             "service" => $requestRecords[0]['service'],