From f426db28c8ee2e4df7e80e57fcfc767c560f1f05 Mon Sep 17 00:00:00 2001
From: singhharsh1708 <hs1663531@gmail.com>
Date: Sun, 6 Sep 2026 14:19:38 +0530
Subject: [PATCH] fix: escape names and paths written into html

---
 web/ajax/modals/storage.php                      | 6 +++---
 web/skins/classic/views/_options_controlcaps.php | 2 +-
 web/skins/classic/views/event.php                | 2 +-
 web/skins/classic/views/report.php               | 2 +-
 web/skins/classic/views/timeline.php             | 4 ++--
 5 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/web/ajax/modals/storage.php b/web/ajax/modals/storage.php
index 3abc72e26..b8de0db2b 100644
--- a/web/ajax/modals/storage.php
+++ b/web/ajax/modals/storage.php
@@ -59,15 +59,15 @@
           <tbody>
             <tr>
               <th class="text-right " scope="row"><?php echo translate('Name') ?></th>
-              <td><input type="text" name="newStorage[Name]" value="<?php echo $newStorage->Name() ?>"/></td>
+              <td><input type="text" name="newStorage[Name]" value="<?php echo validHtmlStr($newStorage->Name()) ?>"/></td>
             </tr>
             <tr>
               <th class="text-right " scope="row"><?php echo translate('Path') ?></th>
-              <td><input type="text" name="newStorage[Path]" value="<?php echo $newStorage->Path() ?>"/></td>
+              <td><input type="text" name="newStorage[Path]" value="<?php echo validHtmlStr($newStorage->Path()) ?>"/></td>
             </tr>
             <tr>
               <th class="text-right " scope="row"><?php echo translate('Url') ?></th>
-              <td><input type="text" name="newStorage[Url]" value="<?php echo $newStorage->Url() ?>"/></td>
+              <td><input type="text" name="newStorage[Url]" value="<?php echo validHtmlStr($newStorage->Url()) ?>"/></td>
             </tr>
             <tr>
               <th class="text-right " scope="row"><?php echo translate('Server') ?></th>
diff --git a/web/skins/classic/views/_options_controlcaps.php b/web/skins/classic/views/_options_controlcaps.php
index aab6d2525..d699b8685 100644
--- a/web/skins/classic/views/_options_controlcaps.php
+++ b/web/skins/classic/views/_options_controlcaps.php
@@ -58,7 +58,7 @@ foreach( $controls as $control ) {
           <tr>
             <td class="colMark" data-checkbox="true"></td>
             <td class="colId"><?php echo $control['Id'] ?></td>
-            <td class="colName"><?php echo $control['Name'] ?></td>
+            <td class="colName"><?php echo validHtmlStr($control['Name']) ?></td>
             <td class="colType"><?php echo $control['Type'] ?></td>
             <td class="colProtocol"><?php echo validHtmlStr($control['Protocol']) ?></td>
             <td class="colCanMove"><?php echo $control['CanMove']?translate('Yes'):translate('No') ?></td>
diff --git a/web/skins/classic/views/event.php b/web/skins/classic/views/event.php
index e1ce6e85c..724fdc857 100644
--- a/web/skins/classic/views/event.php
+++ b/web/skins/classic/views/event.php
@@ -492,7 +492,7 @@ if (defined('AUDIO_MOTION_ENABLED') && AUDIO_MOTION_ENABLED) echo '
 ' . PHP_EOL;
 ?>
                 <div class="monitorStatus">
-                  <span class="MonitorName"><?php echo $monitor->Name() . " (". translate('ID'). "=" . $monitor->Id() . ")"; ?>  </span>
+                  <span class="MonitorName"><?php echo validHtmlStr($monitor->Name()) . " (". translate('ID'). "=" . $monitor->Id() . ")"; ?>  </span>
                   <span class="stream-info-status-track"></span>
                 </div>
                 <p id="dvrControls">
diff --git a/web/skins/classic/views/report.php b/web/skins/classic/views/report.php
index aefd1144d..d6ac92326 100644
--- a/web/skins/classic/views/report.php
+++ b/web/skins/classic/views/report.php
@@ -54,7 +54,7 @@ getBodyTopHTML();
           <tbody>
             <tr>
               <th class="text-right" scope="row"><?php echo translate('Name') ?></th>
-              <td><input type="text" name="Report[Name]" value="<?php echo $report->Name() ?>"/></td>
+              <td><input type="text" name="Report[Name]" value="<?php echo validHtmlStr($report->Name()) ?>"/></td>
             </tr>
             <tr>
               <th class="text-right " scope="row"><?php echo translate('Filter') ?></th>
diff --git a/web/skins/classic/views/timeline.php b/web/skins/classic/views/timeline.php
index ca0aafc4d..c7f260296 100644
--- a/web/skins/classic/views/timeline.php
+++ b/web/skins/classic/views/timeline.php
@@ -810,8 +810,8 @@ foreach ( array_keys($monEventSlots) as $monitorId ) {
 <?php
 foreach( array_keys($monEventSlots) as $monitorId ) {
 ?>
-          <span class="keyEntry"><?php echo $monitors[$monitorId]->Name() ?>
-          <div id="keyBox<?php echo $monitorId ?>" class="keyBox monitorColour<?php echo $monitorId ?>" title="<?php echo $monitors[$monitorId]->Name() ?>" style="background-color: <?php echo $monitors[$monitorId]->WebColour() ?>;"></div>
+          <span class="keyEntry"><?php echo validHtmlStr($monitors[$monitorId]->Name()) ?>
+          <div id="keyBox<?php echo $monitorId ?>" class="keyBox monitorColour<?php echo $monitorId ?>" title="<?php echo validHtmlStr($monitors[$monitorId]->Name()) ?>" style="background-color: <?php echo $monitors[$monitorId]->WebColour() ?>;"></div>
           </span>
 <?php
 }