Skip to content

Commit 349062d

Browse files
committed
Security: Refactor hidden input generation using Display::input
Replaced manual HTML string construction with the Display::input method for hidden inputs. This improves code readability, maintainability, and aligns with existing utility usage. Security measures with Security::remove_XSS remain intact. See advisory GHSA-7p5f-34rx-49h8
1 parent 8ad4d51 commit 349062d

File tree

1 file changed

+10
-4
lines changed

1 file changed

+10
-4
lines changed

main/inc/lib/sortable_table.class.php

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -444,12 +444,18 @@ class="form-search"
444444
foreach ($this->additional_parameters as $key => $value) {
445445
if (is_array($value)) {
446446
foreach ($value as $subKey => $subValue) {
447-
$html .= '<input type="hidden" name ="'.Security::remove_XSS($subKey).'" value ="'
448-
.Security::remove_XSS($subValue).'" />';
447+
$html .= Display::input(
448+
'hidden',
449+
Security::remove_XSS($subKey),
450+
Security::remove_XSS($subValue)
451+
);
449452
}
450453
} else {
451-
$html .= '<input type="hidden" name ="'.Security::remove_XSS($key).'" value ="'
452-
.Security::remove_XSS($value).'" />';
454+
$html .= Display::input(
455+
'hidden',
456+
Security::remove_XSS($key),
457+
Security::remove_XSS($value)
458+
);
453459
}
454460
}
455461
}

0 commit comments

Comments
 (0)