Fixed issue #16904: Check attributes are escaped properly (#1803)

LimeSurvey · Mar 25, 2021 · bc372a8 · bc372a8
1 parent 8100d01
commit bc372a8
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/application/views/questionAdministration/answerOptionRow.twig b/application/views/questionAdministration/answerOptionRow.twig
@@ -115,7 +115,7 @@
                 id='answeroptions[{{ answerOption.aid }}][{{ scale_id }}][answeroptionl10n][{{ language }}]'
                 name='answeroptions[{{ answerOption.aid }}][{{ scale_id }}][answeroptionl10n][{{ language }}]'
                 placeholder='{{ gT("Some example answer option") }}'
-                value="{{ answerOptionl10n.answer }}"
+                value="{{ answerOptionl10n.answer|escape('html_attr') }}"
             />
             <span class="input-group-addon">
                 {{ getEditor(