Merge pull request #1989 from owncloud/selectSanitize

Sanitize HTML in html_select_options
2013-02-28 08:51:07 +07:00 · 2013-02-28 08:51:07 +07:00 · 1cc7e6d31a
parent 93e713d378 cef6131ea8
commit 1cc7e6d31a
1 changed files with 1 additions and 1 deletions
--- a/lib/template.php
+++ b/lib/template.php
@ -147,7 +147,7 @@ function html_select_options($options, $selected, $params=array()) {
 			$label = $label[$label_name];
 		}
 		$select = in_array($value, $selected) ? ' selected="selected"' : '';
-		$html .= '<option value="' . $value . '"' . $select . '>' . $label . '</option>'."\n";
+		$html .= '<option value="' . OC_Util::sanitizeHTML($value) . '"' . $select . '>' . OC_Util::sanitizeHTML($label) . '</option>'."\n";
 	}
 	return $html;
 }