Add htmlspecialchars function for nameTag

Fix bug stored XSS in Tags Disclosure: https://huntr.dev/bounties/a11bca75-f8a8-449d-82cd-d463bfd84f72
krayin · Nov 29, 2021 · d0fd404 · d0fd404
1 parent 003545e
commit d0fd404
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/packages/Webkul/Admin/src/DataGrids/Setting/TagDataGrid.php b/packages/Webkul/Admin/src/DataGrids/Setting/TagDataGrid.php
@@ -91,7 +91,7 @@ public function addColumns()
                 $html = '<span style="background: ' . ($row->color ?? '#546E7A') . ';width: 15px;height: 15px;margin-top: 3px;border-radius: 50%;float: left;margin-right: 10px;box-shadow: 0px 4px 15.36px 0.75px rgb(0 0 0 / 10%), 0px 2px 6px 0px rgb(0 0 0 / 15%);"></span>';
 
 
-                return $html . $row->name;
+                return $html . htmlspecialchars($row->name);
             },
         ]);