diff options
| author | Ivan Kohler <ivan@freeside.biz> | 2014-10-09 11:11:27 -0700 |
|---|---|---|
| committer | Ivan Kohler <ivan@freeside.biz> | 2014-10-09 11:11:27 -0700 |
| commit | 003eca97bc3a50b8f52a0713273ad60459e00c8f (patch) | |
| tree | c288868ac5789e78af92c403cd3b9254820792ef | |
| parent | 3146245f510ef873c4176bc06dc891f990db8f1e (diff) | |
XSS
| -rw-r--r-- | httemplate/browse/part_event.html | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/httemplate/browse/part_event.html b/httemplate/browse/part_event.html index 575294edd..4b95b86f5 100644 --- a/httemplate/browse/part_event.html +++ b/httemplate/browse/part_event.html @@ -175,8 +175,10 @@ my $html_init = ' or <SELECT NAME="clone"><OPTION></OPTION>'; foreach my $part_event ( qsearch('part_event', {'disabled'=>''}) ) { - $html_init .= '<OPTION VALUE="'. $part_event->eventpart. '">'. - $part_event->eventpart. ': '. $part_event->event. '</OPTION>'; + $html_init .= '<OPTION VALUE="'. $part_event->eventpart. '">'. + $part_event->eventpart. ': '. + encode_entities($part_event->event). + '</OPTION>'; } $html_init .= '</SELECT><INPUT TYPE="submit" VALUE="Clone existing event">'. |