Documents: Move form, add remove_xss

chamilo · Aug 2, 2021 · 78f74d3 · 78f74d3
1 parent f539afe
commit 78f74d3
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/main/document/document.php b/main/document/document.php
@@ -1090,7 +1090,7 @@ function convertModal (id, format) {
                 false,
                 $curdirpath
             );
-            $moveForm .= '<legend>'.get_lang('Move').': '.$document_to_move['title'].'</legend>';
+            $moveForm .= '<legend>'.get_lang('Move').': '.Security::remove_XSS($document_to_move['title']).'</legend>';
 
             // filter if is my shared folder. TODO: move this code to build_move_to_selector function
             if (DocumentManager::is_my_shared_folder(api_get_user_id(), $curdirpath, $sessionId) &&

diff --git a/main/inc/lib/document.lib.php b/main/inc/lib/document.lib.php
@@ -5049,7 +5049,7 @@ public static function build_directory_selector(
 
         if (is_array($folders)) {
             $escaped_folders = [];
-            foreach ($folders as $key => &$val) {
+            foreach ($folders as $key => $val) {
                 $escaped_folders[$key] = Database::escape_string($val);
             }
             $folder_sql = implode("','", $escaped_folders);
@@ -5097,6 +5097,7 @@ public static function build_directory_selector(
                     } else {
                         $label = ' &mdash; '.$folder_titles[$folder];
                     }
+                    $label = Security::remove_XSS($label);
                     $parent_select->addOption($label, $folder_id);
                     if ($selected != '') {
                         $parent_select->setSelected($folder_id);