Fixed issue #09458: Under specific condition : HTMLPurifier inserts !…

… characters at random into emailed surveys Dev: No need complete HTML for answer table . Maybe just have question code can be better.
LimeSurvey · Feb 2, 2015 · 77ae8e3 · 77ae8e3
1 parent f33f2a3
commit 77ae8e3
Showing 1 changed file with 4 additions and 5 deletions.
diff --git a/application/helpers/frontend_helper.php b/application/helpers/frontend_helper.php
@@ -693,17 +693,17 @@ function sendSubmitNotifications($surveyid)
         {
             if (substr($sFieldname,0,4)=='gid_')
             {
-                $ResultTableHTML .= "\t<tr class='printanswersgroup'><td colspan='2'>{$fname[0]}</td></tr>\n";
+                $ResultTableHTML .= "\t<tr class='printanswersgroup'><td colspan='2'>".strip_tags($fname[0])."</td></tr>\n";
                 $ResultTableText .="\n{$fname[0]}\n\n";
             }
             elseif (substr($sFieldname,0,4)=='qid_')
             {
-                $ResultTableHTML .= "\t<tr class='printanswersquestionhead'><td  colspan='2'>{$fname[0]}</td></tr>\n";
+                $ResultTableHTML .= "\t<tr class='printanswersquestionhead'><td  colspan='2'>".strip_tags($fname[0])."</td></tr>\n";
                 $ResultTableText .="\n{$fname[0]}\n";
             }
             else
             {
-                $ResultTableHTML .= "\t<tr class='printanswersquestion'><td>{$fname[0]} {$fname[1]}</td><td class='printanswersanswertext'>".CHtml::encode($fname[2])."</td></tr>\n";
+                $ResultTableHTML .= "\t<tr class='printanswersquestion'><td>".strip_tags("{$fname[0]} {$fname[1]}")."</td><td class='printanswersanswertext'>".CHtml::encode($fname[2])."</td></tr>\n";
                 $ResultTableText .="     {$fname[0]} {$fname[1]}: {$fname[2]}\n";
             }
         }
@@ -712,8 +712,7 @@ function sendSubmitNotifications($surveyid)
         $ResultTableText .= "\n\n";
         if ($bIsHTML)
         {
-            $filter = new CHtmlPurifier();
-            $aReplacementVars['ANSWERTABLE']=$filter->purify($ResultTableHTML);
+            $aReplacementVars['ANSWERTABLE']=$ResultTableHTML;
         }
         else
         {