From 730b7a71d69ddb650313bd969cfa843a5322fd21 Mon Sep 17 00:00:00 2001
From: Jared Hancock <jared@osticket.com>
Date: Tue, 21 Jul 2015 10:00:08 -0500
Subject: [PATCH] xss: Properly escape choices when rendered
---
include/class.forms.php | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/class.forms.php b/include/class.forms.php
index 70cf1a8b5..051850690 100644
--- a/include/class.forms.php
+++ b/include/class.forms.php
@@ -1091,7 +1091,7 @@ class ChoicesWidget extends Widget {
continue; ?>
<option value="<?php echo $key; ?>" <?php
if ($value == $key) echo 'selected="selected"';
- ?>><?php echo $name; ?></option>
+ ?>><?php echo Format::htmlchars($name); ?></option>
<?php } ?>
</select>
</span>
--
GitLab