From 5a952a1091840407b32fcaa86bc638f187ad5ea1 Mon Sep 17 00:00:00 2001
From: Kobi Shmueli <kobi@macron.co.il>
Date: Thu, 20 Oct 2016 14:13:13 +0300
Subject: [PATCH] Added html escaping to php/karnaf/mng_viewlogs.php.

-Kobi.
---
 CHANGES                     | 1 +
 php/karnaf/mng_viewlogs.php | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGES b/CHANGES
index 3104c93..6458f81 100644
--- a/CHANGES
+++ b/CHANGES
@@ -13,6 +13,7 @@ Karnaf v5.0.17
 - Added priority to statuses in order to control the status list order.
 - Changed php/karnaf/new.php to automatically get the user's full name.
 - Made sure the cc variable is set on php/karnaf-scripts/fetch-emails.php.
+- Added html escaping to php/karnaf/mng_viewlogs.php.
 
 Karnaf v5.0.16
 - Let opers choose the assigned group for new tickets they open.
diff --git a/php/karnaf/mng_viewlogs.php b/php/karnaf/mng_viewlogs.php
index 97cdbf8..1ae807d 100755
--- a/php/karnaf/mng_viewlogs.php
+++ b/php/karnaf/mng_viewlogs.php
@@ -90,7 +90,7 @@
 <td class=<?=$class?>><?=$sdate?></td>
 <td class=<?=$class?>><?=$result['ip']?></td>
 <td class=<?=$class?>><?=$result['user']?></td>
-<td class=<?=$class?>><b><?=strtoupper($result['logtype'])?></b> -> <?=$result['action']?></td>
+<td class=<?=$class?>><b><?=strtoupper($result['logtype'])?></b> -> <?=fix_html($result['action'])?></td>
 </tr>
 <?
   }