Security fix in Properties Parameter (#14825)

pimcore · Apr 18, 2023 · 9fc6748 · 9fc6748
1 parent fb3056a
commit 9fc6748
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/bundles/AdminBundle/Resources/public/js/pimcore/document/editables/link.js b/bundles/AdminBundle/Resources/public/js/pimcore/document/editables/link.js
@@ -98,7 +98,7 @@ pimcore.document.editables.link = Class.create(pimcore.document.editable, {
             text = this.data.path;
         }
         if (this.data.path || this.data.anchor || this.data.parameters) {
-            let fullpath = this.data.path + (this.data.parameters ? '?' + this.data.parameters : '') + (this.data.anchor ? '#' + this.data.anchor : '');
+            let fullpath = this.data.path + (this.data.parameters ? '?' + Ext.util.Format.htmlEncode(this.data.parameters) : '') + (this.data.anchor ? '#' + Ext.util.Format.htmlEncode(this.data.anchor) : '');
             let displayHtml = Ext.util.Format.htmlEncode(text);
 
             if (this.config.textPrefix !== undefined) {