Fix: js not escaped

Dolibarr · May 30, 2012 · 92fe8eb · 92fe8eb
1 parent fd95659
commit 92fe8eb
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/htdocs/core/class/html.form.class.php b/htdocs/core/class/html.form.class.php
@@ -2262,9 +2262,9 @@ function formconfirm($page, $title, $question, $action, $formquestion='', $selec
 			             		});
 			             		//alert(options);
 			             	}
-			             	location.href=\''.$pageyes.'\' + options;
+			             	location.href=\''.dol_escape_js($pageyes).'\' + options;
 			             }
-                         '.($pageno?'if (choice == \'ko\') location.href=\''.$pageno.'\';':'').'
+                         '.($pageno?'if (choice == \'ko\') location.href=\''.dol_escape_js($pageno).'\';':'').'
 		              },
 			        buttons: {
 			            \''.dol_escape_js($langs->transnoentities("Yes")).'\': function() {