arman/science-ation
1
1
Fork 0
forked from science-ation/science-ation
Code Pull Requests Activity

Properly escape the email name in the javascript function, and htmlspecialchars the name in the output

Browse Source
This commit is contained in:
james 2010-02-12 18:24:22 +00:00
parent 0f746fb914
commit 1768fffb2b
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
admin/communication.php
View File

@ -605,7 +605,7 @@ case "email_get_list":
if($r->name) $name=$r->name;
else $name=i18n("no email name specified");
echo "<tr><td><a href=\"#\" onclick=\"return opencommunicationeditor('$r->val',$r->id,$fcid)\">$name</a></td>";
echo "<tr><td><a href=\"#\" onclick=\"return opencommunicationeditor('".addslashes($r->val)."',$r->id,$fcid)\">",htmlspecialchars($name)."</a></td>";
echo "<td>$r->type</td>";
echo " <td align=\"center\">";