diff options
| author | Daniel Schmitzer <noreply@maennchen1.de> | 2017-12-11 16:18:05 +0000 |
|---|---|---|
| committer | Daniel Schmitzer <noreply@maennchen1.de> | 2017-12-11 16:18:05 +0000 |
| commit | 3272bfab6d14d9bd56c8e1586564e25d817acb53 (patch) | |
| tree | 4e61a10c23751a7dbbb62645eaafdfee338c4ee9 /views/mods/mod_productindex/layouts | |
| parent | e47b05c69847862deab7d7fc431315ac56e0e2a8 (diff) | |
- Cross Site Scripting in Produktübersichten verhindert4.0.4
git-svn-id: https://[internal]/wordpress/plugins/wpsg4@6812 0d5edaf7-2b12-4e95-93f4-047927463d4b
Diffstat (limited to 'views/mods/mod_productindex/layouts')
| -rw-r--r-- | views/mods/mod_productindex/layouts/grid.phtml | 2 | ||||
| -rw-r--r-- | views/mods/mod_productindex/layouts/list.phtml | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/views/mods/mod_productindex/layouts/grid.phtml b/views/mods/mod_productindex/layouts/grid.phtml index 6a71fb5..c23b4f7 100644 --- a/views/mods/mod_productindex/layouts/grid.phtml +++ b/views/mods/mod_productindex/layouts/grid.phtml @@ -31,7 +31,7 @@ <form method="get" id="wpsg_mod_productindex_form" action="<?php echo $_SERVER['REQUEST_URI']; ?>">
<?php parse_str($_SERVER['QUERY_STRING'], $arGET); if (wpsg_isSizedArray($arGET)) { foreach ($arGET as $key => $value) { if (!wpsg_isSizedArray($value)) { ?>
- <input type="hidden" name="<?php echo $key; ?>" value="<?php echo $value; ?>" />
+ <input type="hidden" name="<?php echo $key; ?>" value="<?php echo htmlspecialchars($value); ?>" />
<?php } } } ?>
<input type="hidden" id="wpsg_mod_productindex_filter_page" name="wpsg_mod_productindex[filter][page]" value="<?php echo $this->view['wpsg_mod_productindex']['filter']['page']; ?>" />
diff --git a/views/mods/mod_productindex/layouts/list.phtml b/views/mods/mod_productindex/layouts/list.phtml index a1ddea2..4fa8528 100644 --- a/views/mods/mod_productindex/layouts/list.phtml +++ b/views/mods/mod_productindex/layouts/list.phtml @@ -29,7 +29,7 @@ <form method="get" id="wpsg_mod_productindex_form" action="<?php echo $_SERVER['REQUEST_URI']; ?>">
<?php parse_str($_SERVER['QUERY_STRING'], $arGET); if (wpsg_isSizedArray($arGET)) { foreach ($arGET as $key => $value) { if (!wpsg_isSizedArray($value)) { ?>
- <input type="hidden" name="<?php echo $key; ?>" value="<?php echo $value; ?>" />
+ <input type="hidden" name="<?php echo $key; ?>" value="<?php echo htmlspecialchars($value); ?>" />
<?php } } } ?>
<input type="hidden" id="wpsg_mod_productindex_filter_page" name="wpsg_mod_productindex[filter][page]" value="<?php echo $this->view['wpsg_mod_productindex']['filter']['page']; ?>" />
|