Add Erticaz Press theme (themes/erticazPress) v1.0.0

[haydary1986]

Add new theme: Erticaz Press

This PR adds Erticaz Press, a free, open-source (GPL-3.0) institutional theme for OJS.

• Category: themes · Product: erticazPress
• Repository: https://github.com/haydary1986/erticaz-press-ojs-theme
• Release package: https://github.com/haydary1986/erticaz-press-ojs-theme/releases/download/v1.0.0/erticazPress.tar.gz
• Version: 1.0.0.0 · MD5: 5040cce2049a85976a6dca45124217a6
• Compatibility: OJS 3.4.x and 3.5.x
• License: GNU GPL v3

About the theme

A child of the OJS Default theme that gives any journal a clean, institutional (Elsevier/Springer-style) look: a full-width home page with an institutional masthead, a key-facts band, an indexing & abstracting grid and a title-only current-issue list, plus comprehensive styling for every sub-page (article, archive, search, announcements, forms, pagination, masthead). One-colour palette system, full RTL support and bundled English / Arabic / Turkish locales.

The new <plugin> entry is appended at the end of plugins.xml and is well-formed; the release URL is live and its MD5 matches the file above.

Thank you for maintaining the gallery! 🙏

[asmecher]

Thanks, @haydary1986! At a glance it looks like you may need to escape some of the theme settings to prevent XSS injection; see e.g. https://github.com/pkp/pkp-lib/issues/11974 for similar changes needed for similar changes made to another theme.

[haydary1986]

Thanks for the quick and helpful review, @asmecher! 🙏

You're right. I've audited every theme setting and hardened them against CSS/XSS injection, following the approach in pkp/pkp-lib#11974:

• Colour options (baseColour, accentColour) are validated against /^#([0-9a-fA-F]{3}|[0-9a-fA-F]{6})$/ in saveOption(), and re-validated with getValidColour() immediately before they are injected into the compiled LESS — so only # + hex can ever reach the stylesheet variables.
• Free-text settings (tagline, frequency, article fees, peer-review type) are now strip_tags()-sanitised both on save and when read, and they are |escaped at every output point in the template.

These fixes are published as v1.1.0, and I've updated this PR to point to the new release (new package URL + MD5):
https://github.com/haydary1986/erticaz-press-ojs-theme/releases/tag/v1.1.0

Thanks again for maintaining the gallery and for the careful review!