filter.php: Escape the filter name on output. Fixes #2455

ZoneMinder · Feb 9, 2019 · 70e59ed · 70e59ed
1 parent b2a97ee
commit 70e59ed
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/web/skins/classic/views/filter.php b/web/skins/classic/views/filter.php
@@ -188,7 +188,7 @@
         <?php } ?>
         <p class="Name">
           <label for="filter[Name]"><?php echo translate('Name') ?></label>
-          <input type="text" id="filter[Name]" name="filter[Name]" value="<?php echo $filter->Name() ?>" oninput="updateButtons(this);"/>
+          <input type="text" id="filter[Name]" name="filter[Name]" value="<?php echo validHtmlStr($filter->Name()) ?>" oninput="updateButtons(this);"/>
         </p>
         <table id="fieldsTable" class="filterTable">
           <tbody>