File tree Expand file tree Collapse file tree 2 files changed +3
-2
lines changed Expand file tree Collapse file tree 2 files changed +3
-2
lines changed Original file line number Diff line number Diff line change @@ -1090,7 +1090,7 @@ function convertModal (id, format) {
1090
1090
false ,
1091
1091
$ curdirpath
1092
1092
);
1093
- $ moveForm .= '<legend> ' .get_lang ('Move ' ).': ' .$ document_to_move ['title ' ].'</legend> ' ;
1093
+ $ moveForm .= '<legend> ' .get_lang ('Move ' ).': ' .Security:: remove_XSS ( $ document_to_move ['title ' ]) .'</legend> ' ;
1094
1094
1095
1095
// filter if is my shared folder. TODO: move this code to build_move_to_selector function
1096
1096
if (DocumentManager::is_my_shared_folder (api_get_user_id (), $ curdirpath , $ sessionId ) &&
Original file line number Diff line number Diff line change @@ -5049,7 +5049,7 @@ public static function build_directory_selector(
5049
5049
5050
5050
if (is_array ($ folders )) {
5051
5051
$ escaped_folders = [];
5052
- foreach ($ folders as $ key => & $ val ) {
5052
+ foreach ($ folders as $ key => $ val ) {
5053
5053
$ escaped_folders [$ key ] = Database::escape_string ($ val );
5054
5054
}
5055
5055
$ folder_sql = implode ("',' " , $ escaped_folders );
@@ -5097,6 +5097,7 @@ public static function build_directory_selector(
5097
5097
} else {
5098
5098
$ label = ' — ' .$ folder_titles [$ folder ];
5099
5099
}
5100
+ $ label = Security::remove_XSS ($ label );
5100
5101
$ parent_select ->addOption ($ label , $ folder_id );
5101
5102
if ($ selected != '' ) {
5102
5103
$ parent_select ->setSelected ($ folder_id );
You can’t perform that action at this time.
0 commit comments