escape the message to protect against xss

joomla · Feb 17, 2021 · ad1c86e · ad1c86e
1 parent 4a6f30e
commit ad1c86e
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/administrator/components/com_messages/views/message/tmpl/default.php b/administrator/components/com_messages/views/message/tmpl/default.php
@@ -43,7 +43,7 @@
 				<?php echo JText::_('COM_MESSAGES_FIELD_MESSAGE_LABEL'); ?>
 			</div>
 			<div class="controls">
-				<?php echo $this->item->message; ?>
+				<?php echo $this->escape($this->item->message); ?>
 			</div>
 		</div>
 		<input type="hidden" name="task" value="" />