Browse Source

Escape gradebook name in gradebook_list.php to avoid XSS - refs #2746

Yannick Warnier 6 years ago
parent
commit
814049e5bd
1 changed files with 1 additions and 1 deletions
  1. 1 1
      main/template/default/admin/gradebook_list.tpl

+ 1 - 1
main/template/default/admin/gradebook_list.tpl

@@ -15,7 +15,7 @@
         {% for item in gradebook_list %}
             <tr>
                 <td>
-                    {{ item.name }}
+                    {{ item.name | e }}
                 </td>
                 <td>
                     {{ item.courseCode }}