Dashboard settings: escape panes' names to prevent XSS

2016-02-23 14:00:07 +01:00 · 2016-02-23 14:00:07 +01:00 · b670855f25
parent 358b20cec3
commit b670855f25
1 changed files with 1 additions and 1 deletions
--- a/application/views/scripts/dashboard/settings.phtml
+++ b/application/views/scripts/dashboard/settings.phtml
@ -20,7 +20,7 @@
            <?php foreach ($this->dashboard->getPanes() as $pane): ?>
                <tr style="background-color: #f1f1f1;">
                    <th colspan="2" style="text-align: left; padding: 0.5em;">
-                        <?= $pane->getName(); ?>
+                        <?= $this->escape($pane->getName()) ?>
                    </th>
                    <th>
                        <?= $this->qlink(