Release v5.2.0

.gitignore

@@ -59,7 +59,6 @@ Temporary Items
 vendor/*
 Var/Tmp/*
 Var/Logs/*
-composer-update-dev.cmd
-composer-update.cmd
-composer.dev.json
-composer.dev.lock
+composer-update-dev.*
+composer-update.*
+composer.dev.*

.htaccess

@@ -8,7 +8,7 @@ Options -Indexes
 
 	# forbid the direct access to app directories (eg. config-files, ...)
 	RewriteRule ^(\.databases|App|Libs|vendor|Var/Logs)/.*$ / [F,L]
-	RewriteRule ^(composer\.json|\.gitignore|README\.md|LICENCE\.md|web\.config)$ / [F,L]
+	RewriteRule ^(composer|\.gitignore|\.hgignore|README\.md|LICENSE\.md|web\.config)$ / [F,L]
 
 	# basic zend-framework setup see: http://framework.zend.com/manual/en/zend.controller.html
 	RewriteCond %{REQUEST_FILENAME} -s [OR]

App/Controllers/Index.php

@@ -37,11 +37,8 @@ public function NotFoundAction(){
 	public function ErrorAction () {
 		$code = $this->response->GetCode();
 		if ($code === 200) $code = 404;
-		$message = $this->request->GetParam('message', 'a-zA-Z0-9_;, \\/\-\@\:\.');
-		$message = preg_replace('#`([^`]*)`#', '<code>$1</code>', $message);
-		$message = str_replace("\n", '<br />', $message);
-		$this->view->title = "Error $code";
-		$this->view->message = $message;
+		$this->view->title = "Error {$code}";
+		$this->view->message = $this->request->GetParam('message', FALSE);
 		$this->Render('error');
 	}
 }

App/Controllers/System.php

@@ -6,7 +6,11 @@ class System extends Base {
 
 	public function JsErrorsLogAction () {
 		$this->SetViewEnabled(FALSE);
-		if ($this->environment->IsProduction()) return;
+		$sysCfg = $this->GetConfigSystem();
+		$jsErrorsLog = isset($sysCfg->debug->jsErrorsLog)
+			? (bool) $sysCfg->debug->jsErrorsLog
+			: FALSE;
+		if (!$jsErrorsLog) return;
 		$keys = [
 			'message'	=> 1,
 			'uri'		=> 1,
@@ -21,10 +25,9 @@ public function JsErrorsLogAction () {
 		foreach ($keys as $key => $hex) {
 			$param = $this->GetParam($key);
 			if ($hex) $param = self::_hexToStr($param);
-			$param = preg_replace("#[^a-zA-Z0-9/\&\(\)\[\]\.\'\"%\#\$]#", "", $param);
 			$data[$key] = $param;
 		}
-		$msg = json_encode($data);
+		$msg = \MvcCore\Tool::JsonEncode($data, JSON_PRETTY_PRINT);
 		\MvcCore\Debug::Log($msg, \MvcCore\Debug::JAVASCRIPT);
 	}
 

App/Views/Scripts/cd-collection/index.phtml

@@ -24,9 +24,9 @@
 			<?php foreach ($albums as $id => $album): ?>
 				<tr>
 					<td class="right"><?=$album->Id?></td>
-					<td><a href="<?=$url(':Edit', ['id'	=> $album->Id])?>"><?=$album->Title?></a></td>
-					<td><?=$album->Interpret?></td>
-					<td class="right"><?=$album->Year?></td>
+					<td><a href="<?=$url(':Edit', ['id'	=> $album->Id])?>"><?=$escape($album->Title)?></a></td>
+					<td><?=$escape($album->Interpret)?></td>
+					<td class="right"><?=$escape($album->Year)?></td>
 					<td class="center">
 						<form class="delete" action="<?=$url(':Delete', ['absolute' => TRUE])?>" method="post">
 							<input type="hidden" name="<?=$csrfName?>" value="<?=$csrfValue?>" />

App/Views/Scripts/index/error.phtml

@@ -1,4 +1,4 @@
 <?php /** @var \MvcCore\View $this */ ?>
 <h1>Oooops!</h1>
 <p><?=$title?></p>
-<p><?=$message?></p>
+<pre><code><?=$this->Escape($message)?></code></pre>

README.md

@@ -1,6 +1,6 @@
 # MvcCore - Example - CD Collection - With Authentication
 
-[![Latest Stable Version](https://img.shields.io/badge/Stable-v5.1.0-brightgreen.svg?style=plastic)](https://github.com/mvccore/example-cdcol/releases)
+[![Latest Stable Version](https://img.shields.io/badge/Stable-v5.2.0-brightgreen.svg?style=plastic)](https://github.com/mvccore/example-cdcol/releases)
 [![License](https://img.shields.io/badge/License-BSD%203-brightgreen.svg?style=plastic)](https://mvccore.github.io/docs/mvccore/5.0.0/LICENSE.md)
 [![Packager Build](https://img.shields.io/badge/Packager%20Build-passing-brightgreen.svg?style=plastic)](https://github.com/mvccore/packager)
 ![PHP Version](https://img.shields.io/badge/PHP->=5.4-brightgreen.svg?style=plastic)