Cross Site Scripting (XSS) -

[frostnull]

Describe the bug
XSS when a admin click on the link bellow, the g_preview_theme parameter not encoding the double quotes, an attacker could trick the admin to click on that link..
https://demo.gilacms.com/cm/edit_form/postcategory?id=8%22+%3E%3Cscript%3Ealert(1)%3C/script%3E

To Reproduce
Steps to reproduce the behavior:

1. Go to 'https://demo.gilacms.com/admin/content/postcategory'
2. Click on 'edit'
3. With a web proxy like burp intercept that request, and after id= parameter put " "+><script>alert(1)</script>
4. See the alert on browser..

Screenshots
If applicable, add screenshots to help explain your problem.

Desktop (please complete the following information):

• Browser Firefox
• Version 70.0 (64-bit)

Additional context
In fact the attacker could trick any admin to click on
https://demo.gilacms.com/cm/edit_form/postcategory?id=8%22+%3E%3Cscript%3Ealert(1)%3C/script%3E .. and execute javascript..

[frostnull]

[vzuburlis]

Parameters g_preview_theme, t & id (from /cm/edit_form) are being sanitized in version 1.11.6