Fix XSS vulnerability on "site name"

b2evolution · Aug 12, 2016 · dd975ff · dd975ff
1 parent 9a4ab85
commit dd975ff
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/skins_site/_site_body_header.inc.php b/skins_site/_site_body_header.inc.php
@@ -17,8 +17,8 @@
 <?php
 if( $Settings->get( 'notification_logo' ) != '' )
 {
-	$site_title = $Settings->get( 'notification_long_name' ) != '' ? ' title="'.$Settings->get( 'notification_long_name' ).'"' : '';
-	$site_name_text = '<img src="'.$Settings->get( 'notification_logo' ).'" alt="'.$Settings->get( 'notification_short_name' ).'"'.$site_title.' />';
+	$site_title = $Settings->get( 'notification_long_name' ) != '' ? ' title="'.format_to_output( $Settings->get( 'notification_long_name' ), 'htmlattr' ).'"' : '';
+	$site_name_text = '<img src="'.$Settings->get( 'notification_logo' ).'" alt="'.format_to_output( $Settings->get( 'notification_short_name' ), 'htmlattr' ).'"'.$site_title.' />';
 	$site_title_class = ' swhead_logo';
 }
 else