Fixed issue: [security] Minor XSS vulnerability when editing a question

LimeSurvey · Feb 19, 2023 · 7b2bcaa · 7b2bcaa
1 parent 4d39d11
commit 7b2bcaa
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/application/controllers/QuestionAdministrationController.php b/application/controllers/QuestionAdministrationController.php
@@ -117,6 +117,9 @@ public function actionCreate($surveyid)
     public function actionEdit(int $questionId, string $tabOverviewEditor = null)
     {
         $questionId = (int) $questionId;
+        if (!in_array($tabOverviewEditor, ['overview', 'editor'], true)) {
+            $tabOverviewEditor = null;
+        }
 
         /** @var $question Question|null */
         $question = Question::model()->findByPk($questionId);