Skip to content

Commit 968d5d5

Browse files
committed
Sanitize filename in import message
Signed-off-by: Michal Čihař <michal@cihar.com>
1 parent addebbe commit 968d5d5

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

Diff for: import.php

+2-2
Original file line numberDiff line numberDiff line change
@@ -568,9 +568,9 @@
568568
$message->addString($import_notice);
569569
}
570570
if (isset($local_import_file)) {
571-
$message->addString('(' . $local_import_file . ')');
571+
$message->addString('(' . htmlspecialchars($local_import_file) . ')');
572572
} else {
573-
$message->addString('(' . $_FILES['import_file']['name'] . ')');
573+
$message->addString('(' . htmlspecialchars($_FILES['import_file']['name']) . ')');
574574
}
575575
}
576576
}

0 commit comments

Comments
 (0)