Skip to content
Permalink
Browse files
Fix stored xss in nicedit
  • Loading branch information
Ahmad Gneady committed Jul 3, 2021
1 parent 8f72a40 commit f15ab9236750c3269612207ede13c7bad73ebc22
Showing with 1 addition and 1 deletion.
  1. +1 −1 app/clients_dml.php
@@ -428,7 +428,7 @@ function clients_form($selected_id = '', $AllowUpdate = 1, $AllowInsert = 1, $Al
if(!$dvprint) $templateCode = str_replace('<%%VALUE(website)%%>', html_attr($row['website']), $templateCode);
$templateCode = str_replace('<%%URLVALUE(website)%%>', urlencode($urow['website']), $templateCode);
if($AllowUpdate || $AllowInsert) {
$templateCode = str_replace('<%%HTMLAREA(comments)%%>', '<textarea name="comments" id="comments" rows="5">' . html_attr($row['comments']) . '</textarea>', $templateCode);
$templateCode = str_replace('<%%HTMLAREA(comments)%%>', '<textarea name="comments" id="comments" rows="5">' . safe_html(htmlspecialchars_decode($row['comments'])) . '</textarea>', $templateCode);
} else {
$templateCode = str_replace('<%%HTMLAREA(comments)%%>', '<div id="comments" class="form-control-static">' . $row['comments'] . '</div>', $templateCode);
}

0 comments on commit f15ab92

Please sign in to comment.