Make sure to xmlEntities() the CONF_MESSAGE and MIXIN_MESSAGE values …

…as we are inside attributes.
pydio · Dec 11, 2014 · adcc9f5 · adcc9f5
1 parent bc0cb95
commit adcc9f5
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/core/src/core/classes/class.AJXP_XMLWriter.php b/core/src/core/classes/class.AJXP_XMLWriter.php
@@ -300,7 +300,7 @@ public static function replaceAjxpXmlKeywords($xml, $stripSpaces = false)
                 if (array_key_exists($messId, $confMessages)) {
                     $message = $confMessages[$messId];
                 }
-                $xml = str_replace("CONF_MESSAGE[$messId]", $message, $xml);
+                $xml = str_replace("CONF_MESSAGE[$messId]", AJXP_Utils::xmlEntities($message), $xml);
             }
         }
         if (preg_match_all("/MIXIN_MESSAGE(\[.*?\])/", $xml, $matches, PREG_SET_ORDER)) {
@@ -310,7 +310,7 @@ public static function replaceAjxpXmlKeywords($xml, $stripSpaces = false)
                 if (array_key_exists($messId, $confMessages)) {
                     $message = $confMessages[$messId];
                 }
-                $xml = str_replace("MIXIN_MESSAGE[$messId]", $message, $xml);
+                $xml = str_replace("MIXIN_MESSAGE[$messId]", AJXP_Utils::xmlEntities($message), $xml);
             }
         }
         if ($stripSpaces) {