Merge pull request #123 from solspace/fix/SFT-897-vuln

[SFT-897]: patching submissions index vulnerability
solspace · Feb 13, 2024 · 42facd0 · 42facd0
2 parents 9405da6 + 77848e0
commit 42facd0
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 3 deletions.
diff --git a/composer.json b/composer.json
@@ -1,6 +1,6 @@
 {
   "name": "solspace/craft-express-forms",
-  "description": "Intuitive and lightweight form builder that gets the job done but doesn't get in your way.",
+  "description": "Intuitive and lightweight form builder.",
   "version": "2.0.2",
   "type": "craft-plugin",
   "keywords": [
@@ -17,7 +17,7 @@
   ],
   "support": {
     "email": "support@solspace.com",
-    "issues": "https://github.com/solspace/craft-express-forms/issues?state=open",
+    "issues": "https://github.com/solspace/craft-express-forms/issues",
     "source": "https://github.com/solspace/craft-express-forms",
     "docs": "https://docs.solspace.com/craft/express-forms/v2/"
   },
@@ -57,7 +57,7 @@
     "developer": "Solspace",
     "developerUrl": "https://docs.solspace.com/",
     "documentationUrl": "https://docs.solspace.com/craft/express-forms/v2/",
-    "changelogUrl": "https://raw.githubusercontent.com/solspace/craft-express-forms/master/CHANGELOG.md",
+    "changelogUrl": "https://raw.githubusercontent.com/solspace/craft-express-forms/v2/CHANGELOG.md",
     "hooks": {
       "pre-commit": [
         "set -e",

diff --git a/packages/plugin/src/elements/Submission.php b/packages/plugin/src/elements/Submission.php
@@ -192,6 +192,10 @@ public function getTableAttributeHtml(string $attribute): string
                 }
             }
 
+            if (\is_string($value)) {
+                $value = htmlentities($value, \ENT_QUOTES);
+            }
+
             return $value ?? '';
         }