From 3272bfab6d14d9bd56c8e1586564e25d817acb53 Mon Sep 17 00:00:00 2001
From: Daniel Schmitzer <noreply@maennchen1.de>
Date: Mon, 11 Dec 2017 16:18:05 +0000
Subject: - Cross Site Scripting in Produktübersichten verhindert
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

git-svn-id: https://[internal]/wordpress/plugins/wpsg4@6812 0d5edaf7-2b12-4e95-93f4-047927463d4b
---
 views/mods/mod_productindex/layouts/grid.phtml | 2 +-
 views/mods/mod_productindex/layouts/list.phtml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

(limited to 'views')

diff --git a/views/mods/mod_productindex/layouts/grid.phtml b/views/mods/mod_productindex/layouts/grid.phtml
index 6a71fb5..c23b4f7 100644
--- a/views/mods/mod_productindex/layouts/grid.phtml
+++ b/views/mods/mod_productindex/layouts/grid.phtml
@@ -31,7 +31,7 @@
 	<form method="get" id="wpsg_mod_productindex_form" action="<?php echo $_SERVER['REQUEST_URI']; ?>">
 
  		<?php parse_str($_SERVER['QUERY_STRING'], $arGET); if (wpsg_isSizedArray($arGET)) { foreach ($arGET as $key => $value) { if (!wpsg_isSizedArray($value)) { ?>
- 		<input type="hidden" name="<?php echo $key; ?>" value="<?php echo $value; ?>" />
+ 		<input type="hidden" name="<?php echo $key; ?>" value="<?php echo htmlspecialchars($value); ?>" />
  		<?php } } } ?>
 
 		<input type="hidden" id="wpsg_mod_productindex_filter_page" name="wpsg_mod_productindex[filter][page]" value="<?php echo $this->view['wpsg_mod_productindex']['filter']['page']; ?>" />
diff --git a/views/mods/mod_productindex/layouts/list.phtml b/views/mods/mod_productindex/layouts/list.phtml
index a1ddea2..4fa8528 100644
--- a/views/mods/mod_productindex/layouts/list.phtml
+++ b/views/mods/mod_productindex/layouts/list.phtml
@@ -29,7 +29,7 @@
 	<form method="get" id="wpsg_mod_productindex_form" action="<?php echo $_SERVER['REQUEST_URI']; ?>">
 
  		<?php parse_str($_SERVER['QUERY_STRING'], $arGET); if (wpsg_isSizedArray($arGET)) { foreach ($arGET as $key => $value) { if (!wpsg_isSizedArray($value)) { ?>
- 		<input type="hidden" name="<?php echo $key; ?>" value="<?php echo $value; ?>" />
+ 		<input type="hidden" name="<?php echo $key; ?>" value="<?php echo htmlspecialchars($value); ?>" />
  		<?php } } } ?>
 
 		<input type="hidden" id="wpsg_mod_productindex_filter_page" name="wpsg_mod_productindex[filter][page]" value="<?php echo $this->view['wpsg_mod_productindex']['filter']['page']; ?>" />
-- 
cgit v1.2.3