fix: added missing conversion to HTML entities

thorsten · Feb 14, 2023 · fecc803 · fecc803
1 parent ee509f2
commit fecc803
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/phpmyfaq/admin/category.main.php b/phpmyfaq/admin/category.main.php
@@ -21,6 +21,7 @@
 use phpMyFAQ\Category\CategoryRelation;
 use phpMyFAQ\Database;
 use phpMyFAQ\Filter;
+use phpMyFAQ\Strings;
 
 if (!defined('IS_VALID_PHPMYFAQ')) {
     http_response_code(400);
@@ -319,9 +320,10 @@
             foreach ($category->getCategoryTree() as $id => $cat) {
                 // CategoryHelper translated in this language?
                 if ($cat['lang'] == $lang) {
-                    $categoryName = $cat['name'];
+                    $categoryName = Strings::htmlentities($cat['name']);
                 } else {
-                    $categoryName = $cat['name'] . ' (' . $languageCodes[strtoupper($cat['lang'])] . ')';
+                    $categoryName = Strings::htmlentities($cat['name']) .
+                        ' (' . $languageCodes[strtoupper($cat['lang'])] . ')';
                 }