Merge pull request #966 from Crispy-fried-chicken/patch-1

[backport] Realiza sanitização no valor para evitar XSS
portabilis · Sep 5, 2024 · 5520502 · 5520502
2 parents 4c12de0 + 348021a
commit 5520502
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/ieducar/intranet/include/clsCampos.inc.php b/ieducar/intranet/include/clsCampos.inc.php
@@ -1436,6 +1436,7 @@ classe = (classe == \'formmdtd\')? \'formlttd tr_\' + This.nome : \'formmdtd tr_
                         }
 
                         $retorno .= "<input class='{$class}' type='text' name=\"{$nome}\" id=\"{$nome}\" value=\"{$campo_valor}\" size=\"{$componente[4]}\" maxlength=\"{$componente[5]}\" {$evento} {$disabled}> {$componente[7]}";
+                        $campo_valor = ! is_null($campo_valor) ? htmlspecialchars($campo_valor, ENT_QUOTES) : null;
                         break;
 
                     case 'monetario':