- fixed missing htmlentities on formtype SELECT in list entries

Marius Burkard · Marius Burkard · commit 1caeea6a6ebd · 2017-12-29T13:44:15.000+01:00
diff --git a/interface/lib/classes/listform_actions.inc.php b/interface/lib/classes/listform_actions.inc.php
@@ -180,7 +180,7 @@ public function prepareDataRow($rec)
 						$rec['_'.$key.'_'] = (strtolower($rec[$key]) == 'y')?'x16/tick_circle.png':'x16/cross_circle.png';
 					}
 					//* substitute value for select field
-					$rec[$key] = @$field['value'][$rec[$key]];
+					$rec[$key] = $app->functions->htmlentities(@$field['value'][$rec[$key]]);
 				}
 			}
 		}

Original file line number	Diff line number	Diff line change
`@@ -180,7 +180,7 @@ public function prepareDataRow($rec)`
`180`	`180`	`$rec['_'.$key.'_'] = (strtolower($rec[$key]) == 'y')?'x16/tick_circle.png':'x16/cross_circle.png';`
`181`	`181`	`}`
`182`	`182`	`//* substitute value for select field`
`183`		`- $rec[$key] = @$field['value'][$rec[$key]];`
	`183`	`+ $rec[$key] = $app->functions->htmlentities(@$field['value'][$rec[$key]]);`
`184`	`184`	`}`
`185`	`185`	`}`
`186`	`186`	`}`