Another fix for CVE-2020-35132 - closes #137, missed from #130

leenooks · Apr 1, 2023 · 1650d6a · 1650d6a
1 parent c84b2d6
commit 1650d6a
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/lib/PageRender.php b/lib/PageRender.php
@@ -556,7 +556,7 @@ protected function drawOldValuesAttribute($attribute) {
 	final protected function drawOldValueAttribute($attribute,$i) {
 		if (DEBUGTMP) printf('<font size=-2>%s</font><br />',__METHOD__);
 
-		echo $attribute->getOldValue($i);
+		echo htmlspecialchars($attribute->getOldValue($i));
 	}
 
 	/** DRAW DISPLAYED CURRENT VALUES **/