Skip to content

Commit

Permalink
Browse files Browse the repository at this point in the history
Fix stored xss in nicedit
  • Loading branch information
Ahmad Gneady committed Jul 3, 2021
1 parent 8f72a40 commit f15ab92
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion app/clients_dml.php
Expand Up @@ -428,7 +428,7 @@ function clients_form($selected_id = '', $AllowUpdate = 1, $AllowInsert = 1, $Al
if(!$dvprint) $templateCode = str_replace('<%%VALUE(website)%%>', html_attr($row['website']), $templateCode);
$templateCode = str_replace('<%%URLVALUE(website)%%>', urlencode($urow['website']), $templateCode);
if($AllowUpdate || $AllowInsert) {
$templateCode = str_replace('<%%HTMLAREA(comments)%%>', '<textarea name="comments" id="comments" rows="5">' . html_attr($row['comments']) . '</textarea>', $templateCode);
$templateCode = str_replace('<%%HTMLAREA(comments)%%>', '<textarea name="comments" id="comments" rows="5">' . safe_html(htmlspecialchars_decode($row['comments'])) . '</textarea>', $templateCode);
} else {
$templateCode = str_replace('<%%HTMLAREA(comments)%%>', '<div id="comments" class="form-control-static">' . $row['comments'] . '</div>', $templateCode);
}
Expand Down

0 comments on commit f15ab92

Please sign in to comment.