Upgrade 1-11.38

main/inc/lib/pear/HTML/QuickForm/Rule/CompareDate.php

@@ -38,10 +38,8 @@ class HTML_QuickForm_Rule_CompareDate extends HTML_QuickForm_Rule
         if (!is_array($values[0]) && !is_array($values[1])) {
             return api_strtotime($values[0]) < api_strtotime($values[1]);
         } else {
-            $compareFn = create_function(
-                '$a, $b', 'return mktime($a[\'H\'],$a[\'i\'],0,$a[\'M\'],$a[\'d\'],$a[\'Y\']) <=   mktime($b[\'H\'],$b[\'i\'],0,$b[\'M\'],$b[\'d\'],$b[\'Y\'] );'
-            );
-            return $compareFn($values[0], $values[1]);
+            return mktime($values[0]['H'], $values[0]['i'], 0, $values[0]['M'], $values[0]['d'], $values[0]['Y'])
+                <= mktime($values[1]['H'], $values[1]['i'], 0, $values[1]['M'], $values[1]['d'], $values[1]['Y']);
         }
     }
 }

main/inc/lib/pear/HTML/QuickForm/Rule/Date.php

@@ -14,7 +14,6 @@ class Html_Quickform_Rule_Date extends HTML_QuickForm_Rule
 	 */
 	function validate($date, $options)
 	{
-		$compareDate = create_function('$a', 'return checkdate($a[\'M\'],$a[\'d\'],$a[\'Y\']);');
-        return $compareDate($date);
+		return checkdate($date['M'], $date['d'], $date['Y']);
 	}
 }

main/inc/lib/pear/HTML/QuickForm/advmultiselect.php

@@ -773,14 +773,6 @@ class HTML_QuickForm_advmultiselect extends HTML_QuickForm_select
                 $leftAll = "<br /><br /><button $attrStrAdd  /> <em class='fa fa-backward'></em></button>";
             }
 
-            $strHtmlAdd = "<div class='d-flex justify-content-center align-items-center' style='height: 100%; padding-top: 100px;'>
-                <button $attrStrAdd><em class='fa fa-arrow-right'></em></button>
-            </div>";
-
-            $strHtmlRemove = "<div class='d-flex justify-content-center align-items-center' style='padding-top: 10px;'>
-                <button $attrStrRemove><em class='fa fa-arrow-left'></em></button>
-            </div>";
-
             // build the select all button with all its attributes
             $strHtmlAll = '';
 

main/inc/lib/pear/HTML/QuickForm/date.php

@@ -348,14 +348,14 @@ class HTML_QuickForm_date extends HTML_QuickForm_group
                             $this->_options['maxYear'],
                             $this->_options['minYear'] > $this->_options['maxYear']? -1: 1
                         );
-                        array_walk($options, create_function('&$v,$k','$v = substr($v,-2);'));
+                        array_walk($options, function(&$v, $k) { $v = substr($v, -2); });
                         break;
                     case 'h':
                         $options = $this->_createOptionList(1, 12);
                         break;
                     case 'g':
                         $options = $this->_createOptionList(1, 12);
-                        array_walk($options, create_function('&$v,$k', '$v = intval($v);'));
+                        array_walk($options, function(&$v, $k) { $v = intval($v); });
                         break;
                     case 'H':
                         $options = $this->_createOptionList(0, 23);

main/inc/lib/pear/HTML/QuickForm/select.php

@@ -419,8 +419,11 @@ class HTML_QuickForm_select extends HTML_QuickForm_element
                 if (!empty($strValues) && in_array($option['attr']['value'], $strValues, true)) {
                     $option['attr']['selected'] = 'selected';
                 }
-                $strHtml .= $tabs . "<option" . $this->_getAttrString($option['attr']) . '>' .
-                    $option['text'] . "</option>";
+                $strHtml .= $tabs.Display::tag(
+                    'option',
+                    Security::remove_XSS($option['text']),
+                    $option['attr']
+                );
             }
             foreach ($this->_optgroups as $optgroup) {
                 $strHtml .= $tabs . '<optgroup label="' . $optgroup['label'] . '">';
@@ -432,7 +435,11 @@ class HTML_QuickForm_select extends HTML_QuickForm_element
                         $option['selected'] = 'selected';
                     }
 
-                    $strHtml .= $tabs . " <option" . $this->_getAttrString($option) . '>' .$text . "</option>";
+                    $strHtml .= $tabs.Display::tag(
+                        'option',
+                        Security::remove_XSS($text),
+                        $option
+                    );
                 }
                 $strHtml .= "</optgroup>";
             }