@@ -6962,7 +6962,7 @@ private static function parseFile(
6962
6962
$ icon = choose_image ($ path );
6963
6963
$ position = strrpos ($ icon , '. ' );
6964
6964
$ icon = substr ($ icon , 0 , $ position ).'_small.gif ' ;
6965
- $ my_file_title = $ resource ['title ' ];
6965
+ $ my_file_title = Security:: remove_XSS ( $ resource ['title ' ]) ;
6966
6966
$ visibility = $ resource ['visibility ' ];
6967
6967
6968
6968
// If title is empty we try to use the path
@@ -7083,7 +7083,6 @@ private static function parseFolder($folderId, $resource, $lp_id)
7083
7083
return null ;
7084
7084
}
7085
7085
7086
- //$onclick = '';
7087
7086
// if in LP, hidden folder are displayed in grey
7088
7087
$ folder_class_hidden = '' ;
7089
7088
if ($ lp_id ) {
@@ -7098,15 +7097,27 @@ private static function parseFolder($folderId, $resource, $lp_id)
7098
7097
$ return = '<ul class="lp_resource"> ' ;
7099
7098
}
7100
7099
7101
- $ return .= '<li class="doc_folder ' .$ folder_class_hidden .'" id="doc_id_ ' .$ resource ['id ' ].'" style="margin-left: ' .($ num * 18 ).'px; "> ' ;
7100
+ $ return .= '<li
7101
+ class="doc_folder ' .$ folder_class_hidden .'"
7102
+ id="doc_id_ ' .$ resource ['id ' ].'"
7103
+ style="margin-left: ' .($ num * 18 ).'px;"
7104
+ > ' ;
7102
7105
7103
7106
$ image = Display::returnIconPath ('nolines_plus.gif ' );
7104
7107
if (empty ($ path )) {
7105
7108
$ image = Display::returnIconPath ('nolines_minus.gif ' );
7106
7109
}
7107
- $ return .= '<img style="cursor: pointer;" src=" ' .$ image .'" align="absmiddle" id="img_ ' .$ resource ['id ' ].'" ' .$ onclick .'> ' ;
7110
+ $ return .= '<img
7111
+ style="cursor: pointer;"
7112
+ src=" ' .$ image .'"
7113
+ align="absmiddle"
7114
+ id="img_ ' .$ resource ['id ' ].'" ' .$ onclick .'
7115
+ > ' ;
7116
+
7108
7117
$ return .= Display::return_icon ('lp_folder.gif ' ).' ' ;
7109
- $ return .= '<span ' .$ onclick .' style="cursor: pointer;" > ' .$ title .'</span> ' ;
7118
+ $ return .= '<span ' .$ onclick .' style="cursor: pointer;" > ' .
7119
+ Security::remove_XSS ($ title ).
7120
+ '</span> ' ;
7110
7121
$ return .= '</li> ' ;
7111
7122
7112
7123
if (empty ($ path )) {
0 commit comments