Fixing Bug #8184

- Prevent XSS by executing htmlspecialchars during formMerge in all form fields
modxcms · Oct 17, 2013 · 29a366e · 29a366e
1 parent e3d7af4
commit 29a366e
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/assets/snippets/eform/eform.inc.php b/assets/snippets/eform/eform.inc.php
@@ -677,8 +677,8 @@ function formMerge($docText, $docFields, $vClasses='') {
 				if(($datatype=="checkbox"||$datatype=="radio") && $listValue==$docFields[$listName]) $docText = str_replace("[+$listName:$listValue+]","checked='checked'",$docText);
 			}
 		}
-		// prevent XSS for fields with no html type
-		if (isset($fld) && $formats[$listName][2] != 'html') {
+		// prevent XSS for formfields
+		if (isset($fld)) {
 		    $value = htmlspecialchars($value, ENT_QUOTES, $modx->config['modx_charset']);
 		}
 		if(strpos($name,":")===false) $docText = str_replace("[+$name+]",$value,$docText);