From 2fb47bd84d1905b49beab05fcf3f01b00a171c37 Mon Sep 17 00:00:00 2001
From: Peter Rotich <peter@osticket.com>
Date: Wed, 26 Oct 2016 20:09:27 +0000
Subject: [PATCH] XSS: Encode Helpdesk name/title
Encode html chars on helpdesk title
---
include/staff/header.inc.php | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/include/staff/header.inc.php b/include/staff/header.inc.php
index 13a122c54..b89c16ab4 100644
--- a/include/staff/header.inc.php
+++ b/include/staff/header.inc.php
@@ -1,5 +1,9 @@
<?php
header("Content-Type: text/html; charset=UTF-8");
+
+$title = ($ost && ($title=$ost->getPageTitle()))
+ ? $title : ('osTicket :: '.__('Staff Control Panel'));
+
if (!isset($_SERVER['HTTP_X_PJAX'])) { ?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html<?php
@@ -17,7 +21,7 @@ if ($lang) {
<meta http-equiv="cache-control" content="no-cache" />
<meta http-equiv="pragma" content="no-cache" />
<meta http-equiv="x-pjax-version" content="<?php echo GIT_VERSION; ?>">
- <title><?php echo ($ost && ($title=$ost->getPageTitle()))?$title:'osTicket :: '.__('Staff Control Panel'); ?></title>
+ <title><?php echo Format::htmlchars($title); ?></title>
<!--[if IE]>
<style type="text/css">
.tip_shadow { display:block !important; }
--
GitLab