From 3dd160c6635ebd7eb69bf9defc194eb442229db6 Mon Sep 17 00:00:00 2001
From: altatof <christophe@altairis.fr>
Date: Mon, 16 Jan 2017 09:17:37 +0100
Subject: [PATCH] use dol_escape_htmltag
---
htdocs/core/class/extrafields.class.php | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/htdocs/core/class/extrafields.class.php b/htdocs/core/class/extrafields.class.php
index cc6b61b236e..0c9e4f3226e 100644
--- a/htdocs/core/class/extrafields.class.php
+++ b/htdocs/core/class/extrafields.class.php
@@ -739,7 +739,7 @@ class ExtraFields
}
elseif ($type == 'varchar')
{
- $out='<input type="text" class="flat" name="'.$keysuffix.'options_'.$key.$keyprefix.'" size="'.$showsize.'" maxlength="'.$size.'" value="'.htmlentities($value).'"'.($moreparam?$moreparam:'').'>';
+ $out='<input type="text" class="flat" name="'.$keysuffix.'options_'.$key.$keyprefix.'" size="'.$showsize.'" maxlength="'.$size.'" value="'.dol_escape_htmltag($value).'"'.($moreparam?$moreparam:'').'>';
}
elseif ($type == 'text')
{
--
GitLab