sec(Users) XSS in name

tsolucio · Dec 4, 2021 · 1dd4612 · 1dd4612
1 parent a7d0185
commit 1dd4612
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/modules/Vtiger/header.php b/modules/Vtiger/header.php
@@ -24,7 +24,7 @@
 $smarty->assign('HEADERS', $header_array);
 $smarty->assign('THEME', $theme);
 $smarty->assign('IMAGEPATH', $image_path);
-$smarty->assign('USER', $userName);
+$smarty->assign('USER', trim(gtltTagsToHTML($userName)));
 $smarty->assign('CSRFNAME', $GLOBALS['csrf']['input-name']);
 
 $qc_modules = getQuickCreateModules();