Эх сурвалжийг харах

Use htmlspecialchars when parsing a URL see #7564.

Julio Montoya 10 жил өмнө
parent
commit
ba947ae637

+ 2 - 1
main/inc/lib/display.lib.php

@@ -832,7 +832,8 @@ class Display
     public static function url($name, $url, $extra_attributes = array())
     public static function url($name, $url, $extra_attributes = array())
     {
     {
         if (!empty($url)) {
         if (!empty($url)) {
-            $extra_attributes['href']= $url;
+            $url = htmlspecialchars($url, ENT_QUOTES, 'UTF-8');
+            $extra_attributes['href'] = $url;
         }
         }
         return self::tag('a', $name, $extra_attributes);
         return self::tag('a', $name, $extra_attributes);
     }
     }