fix: added missing conversion to HTML entities

thorsten · Feb 12, 2023 · 49db615 · 49db615
1 parent 56295b5
commit 49db615
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 4 deletions.
diff --git a/phpmyfaq/contact.php b/phpmyfaq/contact.php
@@ -49,7 +49,7 @@
         'msgContactOwnText' => nl2br(Strings::htmlspecialchars($faqConfig->get('main.contactInformations'))),
         'msgContactEMail' => $PMF_LANG['msgContactEMail'],
         'msgContactPrivacyNote' => $PMF_LANG['msgContactPrivacyNote'],
-        'privacyURL' => $faqConfig->get('main.privacyURL'),
+        'privacyURL' => Strings::htmlentities($faqConfig->get('main.privacyURL')),
         'msgPrivacyNote' => $PMF_LANG['msgPrivacyNote'],
         'msgNewContentName' => $PMF_LANG['msgNewContentName'],
         'msgNewContentMail' => $PMF_LANG['msgNewContentMail'],

diff --git a/phpmyfaq/index.php b/phpmyfaq/index.php
@@ -619,7 +619,7 @@
         'msgGlossary' => '<a href="./glossary.html">' . $PMF_LANG['ad_menu_glossary'] . '</a>',
         'privacyLink' => sprintf(
             '<a target="_blank" href="%s">%s</a>',
-            $faqConfig->get('main.privacyURL'),
+            Strings::htmlentities($faqConfig->get('main.privacyURL')),
             $PMF_LANG['msgPrivacyNote']
         ),
         'backToHome' => '<a href="./index.html">' . $PMF_LANG['msgHome'] . '</a>',
@@ -642,7 +642,7 @@
         'msgGlossary' => '<a href="index.php?' . $sids . 'action=glossary">' . $PMF_LANG['ad_menu_glossary'] . '</a>',
         'privacyLink' => sprintf(
             '<a target="_blank" href="%s">%s</a>',
-            $faqConfig->get('main.privacyURL'),
+            Strings::htmlentities($faqConfig->get('main.privacyURL')),
             $PMF_LANG['msgPrivacyNote']
         ),
         'allCategories' => '<a class="nav-link" href="index.php?' . $sids . 'action=show">' .

diff --git a/phpmyfaq/request-removal.php b/phpmyfaq/request-removal.php
@@ -18,6 +18,7 @@
 use phpMyFAQ\Captcha;
 use phpMyFAQ\Core\Exception;
 use phpMyFAQ\Helper\CaptchaHelper;
+use phpMyFAQ\Strings;
 use phpMyFAQ\User\CurrentUser;
 
 if (!defined('IS_VALID_PHPMYFAQ')) {
@@ -50,7 +51,7 @@
         'msgContactRemove' => $PMF_LANG['msgContactRemove'],
         'msgContactPrivacyNote' => $PMF_LANG['msgContactPrivacyNote'],
         'msgPrivacyNote' => $PMF_LANG['msgPrivacyNote'],
-        'privacyURL' => $faqConfig->get('main.privacyURL'),
+        'privacyURL' => Strings::htmlentities($faqConfig->get('main.privacyURL')),
         'msgNewContentName' => $PMF_LANG['msgNewContentName'],
         'msgNewContentMail' => $PMF_LANG['msgNewContentMail'],
         'ad_user_loginname' => $PMF_LANG['ad_user_loginname'],