Escape settings fields

LiveHelperChat · Aug 26, 2021 · b1c6a74 · b1c6a74
1 parent 7bd5eb7
commit b1c6a74
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/lhc_web/design/defaulttheme/tpl/lhchatbox/generalsettings.tpl.php b/lhc_web/design/defaulttheme/tpl/lhchatbox/generalsettings.tpl.php
@@ -14,17 +14,17 @@
 
 <div class="form-group">
 <label><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chatbox/generalsettings','Default new chatbox name');?></label>
-<input class="form-control" type="text" name="DefaultName" value="<?php (isset($chatbox_data['chatbox_default_name']) && $chatbox_data['chatbox_default_name'] != '') ? print $chatbox_data['chatbox_default_name'] : print 'Chatbox' ?>" />
+<input class="form-control" type="text" name="DefaultName" value="<?php (isset($chatbox_data['chatbox_default_name']) && $chatbox_data['chatbox_default_name'] != '') ? print htmlspecialchars($chatbox_data['chatbox_default_name']) : print 'Chatbox' ?>" />
 </div>
 
 <div class="form-group">
 <label><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chatbox/generalsettings','Default operator name');?></label>
-<input class="form-control" type="text" name="DefaultOperatorName" value="<?php (isset($chatbox_data['chatbox_default_opname']) && $chatbox_data['chatbox_default_opname'] != '') ? print $chatbox_data['chatbox_default_opname'] : print 'Manager' ?>" />
+<input class="form-control" type="text" name="DefaultOperatorName" value="<?php (isset($chatbox_data['chatbox_default_opname']) && $chatbox_data['chatbox_default_opname'] != '') ? print htmlspecialchars($chatbox_data['chatbox_default_opname']) : print 'Manager' ?>" />
 </div>
 
 <div class="form-group">
 <label><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chatbox/generalsettings','Messages limit in the chatbox');?></label>
-<input class="form-control" type="text" name="MessagesLimit" value="<?php (isset($chatbox_data['chatbox_msg_limit']) && $chatbox_data['chatbox_msg_limit'] != '') ? print $chatbox_data['chatbox_msg_limit'] : print 100 ?>" />
+<input class="form-control" type="text" name="MessagesLimit" value="<?php (isset($chatbox_data['chatbox_msg_limit']) && $chatbox_data['chatbox_msg_limit'] != '') ? print htmlspecialchars($chatbox_data['chatbox_msg_limit']) : print 100 ?>" />
 </div>
 
 <div class="form-group">
@@ -33,7 +33,7 @@
 
 <div class="form-group">
 <label><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chatbox/generalsettings','Secret hash, this is used when auto creation is disabled');?>, <a rel="noreferrer" href="http://livehelperchat.com/documentation-6c.html"><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chatbox/generalsettings','more information on how to use it');?></a></label>
-<input class="form-control" type="text" name="SecretHash" value="<?php (isset($chatbox_data['chatbox_secret_hash']) && $chatbox_data['chatbox_secret_hash'] != '') ? print $chatbox_data['chatbox_secret_hash'] : print erLhcoreClassChat::generateHash() ?>" />
+<input class="form-control" type="text" name="SecretHash" value="<?php (isset($chatbox_data['chatbox_secret_hash']) && $chatbox_data['chatbox_secret_hash'] != '') ? print htmlspecialchars($chatbox_data['chatbox_secret_hash']) : print erLhcoreClassChat::generateHash() ?>" />
 </div>
 
 <input type="submit" class="btn btn-secondary" name="StoreChatboxSettings" value="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/buttons','Save'); ?>" />