Dev: Escape tainted string adminlang

LimeSurvey · Jan 31, 2019 · dfcfe9f · dfcfe9f
1 parent c03183d
commit dfcfe9f
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/application/views/admin/super/header.php b/application/views/admin/super/header.php
@@ -5,7 +5,7 @@
  */
 ?>
 <!DOCTYPE html>
-<html lang="<?php echo str_replace('-informal','',$adminlang); ?>"<?php echo $languageRTL;?> >
+<html lang="<?php echo str_replace('-informal','', htmlspecialchars($adminlang)); ?>"<?php echo $languageRTL;?> >
 <head>
     <meta http-equiv="content-type" content="text/html; charset=UTF-8" />
     <meta http-equiv="X-UA-Compatible" content="IE=edge" />