Fixed issue #19168: [security] XSS in Survey menus (Menu icon type an…

…d Menu icon) (#3635) Co-authored-by: lapiudevgit <devgit@lapiu.biz>
LimeSurvey · Nov 22, 2023 · ea366c4 · ea366c4
1 parent 2e74c7a
commit ea366c4
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/application/models/SurveymenuEntries.php b/application/models/SurveymenuEntries.php
@@ -233,7 +233,7 @@ public static function returnMenuIcon($data)
         if ($data->menu_icon_type == 'fontawesome') {
             return "<i class='fa fa-" . $data->menu_icon . "'></i>";
         } elseif ($data->menu_icon_type == 'image') {
-            return '<img width="60px" src="' . $data->menu_icon . '" />';
+            return '<img width="60px" src="' . CHtml::encode($data->menu_icon) . '" />';
         } else {
             return $data->menu_icon_type . '|' . $data->menu_icon;
         }