Skip to content

Commit 78f74d3

Browse files
committed
Documents: Move form, add remove_xss
1 parent f539afe commit 78f74d3

File tree

2 files changed

+3
-2
lines changed

2 files changed

+3
-2
lines changed

main/document/document.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1090,7 +1090,7 @@ function convertModal (id, format) {
10901090
false,
10911091
$curdirpath
10921092
);
1093-
$moveForm .= '<legend>'.get_lang('Move').': '.$document_to_move['title'].'</legend>';
1093+
$moveForm .= '<legend>'.get_lang('Move').': '.Security::remove_XSS($document_to_move['title']).'</legend>';
10941094

10951095
// filter if is my shared folder. TODO: move this code to build_move_to_selector function
10961096
if (DocumentManager::is_my_shared_folder(api_get_user_id(), $curdirpath, $sessionId) &&

main/inc/lib/document.lib.php

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5049,7 +5049,7 @@ public static function build_directory_selector(
50495049

50505050
if (is_array($folders)) {
50515051
$escaped_folders = [];
5052-
foreach ($folders as $key => &$val) {
5052+
foreach ($folders as $key => $val) {
50535053
$escaped_folders[$key] = Database::escape_string($val);
50545054
}
50555055
$folder_sql = implode("','", $escaped_folders);
@@ -5097,6 +5097,7 @@ public static function build_directory_selector(
50975097
} else {
50985098
$label = ' &mdash; '.$folder_titles[$folder];
50995099
}
5100+
$label = Security::remove_XSS($label);
51005101
$parent_select->addOption($label, $folder_id);
51015102
if ($selected != '') {
51025103
$parent_select->setSelected($folder_id);

0 commit comments

Comments
 (0)