Fixed potential xss vulnerability

qcodo · Jul 18, 2011 · 14c71c0 · 14c71c0
1 parent bcf879c
commit 14c71c0
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/includes/qcodo/_core/qform/QFormBase.class.php b/includes/qcodo/_core/qform/QFormBase.class.php
@@ -908,7 +908,7 @@ protected function RenderBegin($blnDisplayOutput = true) {
 				$strFormAttributes .= ' class="' . $this->strCssClass . '"';
 
 			// Setup Rendered HTML
-			$strToReturn .= sprintf('<form method="post" id="%s" action="%s"%s>', $this->strFormId, QApplication::$RequestUri, $strFormAttributes);
+			$strToReturn .= sprintf('<form method="post" id="%s" action="%s"%s>', $this->strFormId, QApplication::HtmlEntities(QApplication::$RequestUri), $strFormAttributes);
 			$strToReturn .= "\r\n";
 
 			// Include javascripts that need to be included