From b64ef574b82dbf89a908e1569d790c7012d1ccd7 Mon Sep 17 00:00:00 2001
From: Bozhidar Slaveykov <bobi@microweber.com>
Date: Wed, 19 Jan 2022 11:56:21 +0200
Subject: [PATCH] xss on contact form fix

---
 userfiles/modules/admin/notifications/notif_form_entry.php | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/userfiles/modules/admin/notifications/notif_form_entry.php b/userfiles/modules/admin/notifications/notif_form_entry.php
index 586de353b63..dc92f12cbbc 100644
--- a/userfiles/modules/admin/notifications/notif_form_entry.php
+++ b/userfiles/modules/admin/notifications/notif_form_entry.php
@@ -91,7 +91,6 @@
             <hr class="thin" />
             <div class="row">
 
-
                 <?php
                 $iformVr=0;
                 foreach ($form_values_formated as $form_values_row) {
@@ -106,12 +105,12 @@
                             <?php if (!is_array($val1)){ ?>
                                 <div>
                                     <small class="text-muted"><?php echo str_replace('_', ' ', $key); ?>:</small>
-                                    <p><?php print $val1; ?></p>
+                                    <p><?php print htmlentities($val1); ?></p>
                                 </div>
                             <?php } else { ?>
                                 <small class="text-muted"><?php echo str_replace('_', ' ', $key); ?>:</small>
                                 <?php foreach ($val1 as $val1_1){ ?>
-                                    <p><?php print $val1_1 . '<br />'; ?></p>
+                                    <p><?php print htmlentities($val1_1) . '<br />'; ?></p>
                                 <?php }?>
                             <?php } ?>
                         <?php } ?>