From 37f83a9ce7e3333744b1c07c080a187e96d41e66 Mon Sep 17 00:00:00 2001
From: Max Pozdeev <maxpozdeev@gmail.com>
Date: Mon, 20 Sep 2021 13:42:30 +0300
Subject: [PATCH] * rename die2() to logAndDie()

(cherry picked from commit 61bdead0198e81513ae6f8e9b66516f176c6dcba)
---
 src/includes/class.lang.php | 4 ++--
 src/includes/mytinytodo.js  | 8 ++++----
 src/init.php                | 2 +-
 src/mytinytodo_lang.php     | 2 +-
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/src/includes/class.lang.php b/src/includes/class.lang.php
index 8bd4e8e..45a5948 100644
--- a/src/includes/class.lang.php
+++ b/src/includes/class.lang.php
@@ -36,7 +36,7 @@ class Lang
 			$lang->loadDefaultStrings();
 		}
 		else if ( $die == 1 ) {
-			die("Language file not found ($code.json)");
+			die("Language file not found (". htmlspecialchars($code). ".json)");
 		}
 	}
 
@@ -68,7 +68,7 @@ class Lang
 	function loadDefaultStrings()
 	{
 		if ( ! self::langExists($this->default) ) {
-			die("Default language file not found ({$this->default}.json)");
+			die("Default language file not found (". htmlspecialchars($this->default). ".json)");
 		}
 		$defStr = file_get_contents($this->langDir(). "{$this->default}.json");
 		$this->strings = json_decode($defStr, true);
diff --git a/src/includes/mytinytodo.js b/src/includes/mytinytodo.js
index c7343c6..9b2dba7 100644
--- a/src/includes/mytinytodo.js
+++ b/src/includes/mytinytodo.js
@@ -2359,8 +2359,8 @@ function hideList(listId)
 function flashError(str, details)
 {
 	if (details === undefined) details = '';
-	$("#msg>.msg-text").text(str)
-	$("#msg>.msg-details").text(details);
+	$("#msg>.msg-text").text(dehtml(str))
+	$("#msg>.msg-details").text(dehtml(details));
 	$("#loading").hide();
 	$("#msg").addClass('mtt-error').effect("highlight", {color:_mtt.theme.msgFlashColor}, 700);
 }
@@ -2368,8 +2368,8 @@ function flashError(str, details)
 function flashInfo(str, details)
 {
 	if (details === undefined) details = '';
-	$("#msg>.msg-text").text(str)
-	$("#msg>.msg-details").text(details);
+	$("#msg>.msg-text").text(dehtml(str))
+	$("#msg>.msg-details").text(dehtml(details));
 	$("#loading").hide();
 	$("#msg").addClass('mtt-info').effect("highlight", {color:_mtt.theme.msgFlashColor}, 700);
 }
diff --git a/src/init.php b/src/init.php
index ac33265..30f7fa3 100644
--- a/src/init.php
+++ b/src/init.php
@@ -261,7 +261,7 @@ function logAndDie($userText, $errText = null)
 {
 	$errText === null ? error_log($userText) : error_log($errText);
 	if (ini_get('display_errors')) {
-		echo $userText;
+		echo htmlspecialchars($userText);
 	}
 	else {
 		echo "Error! See details in error log.";
diff --git a/src/mytinytodo_lang.php b/src/mytinytodo_lang.php
index f7f2b94..2cab0af 100644
--- a/src/mytinytodo_lang.php
+++ b/src/mytinytodo_lang.php
@@ -257,7 +257,7 @@ class DefaultLang
 	function loadLangHeader($langFile)
 	{
 		if (!file_exists($langFile)) {
-			die("file does not exist: $langFile");
+			die("file does not exist: ". htmlspecialchars($langFile));
 		}
 		$contents = file_get_contents($langFile);