LPS-27282 - Escape chartId param in currency converter portlet

mhan810 · May 14, 2012 · 1274fbe · 1274fbe
1 parent bfc88b1
commit 1274fbe
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/portal-web/docroot/html/portlet/currency_converter/view.jsp b/portal-web/docroot/html/portlet/currency_converter/view.jsp
@@ -24,7 +24,7 @@ com.liferay.portlet.currencyconverter.model.Currency currency = CurrencyUtil.get
 
 double number = ParamUtil.getDouble(request, "number", 1.0);
 
-String chartId = ParamUtil.getString(request, "chartId", "3m");
+String chartId = HtmlUtil.escape(ParamUtil.getString(request, "chartId", "3m"));
 
 NumberFormat decimalFormat = NumberFormat.getNumberInstance(locale);