dbxe
/
fusionpbx
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

BugFix [master] - messages class escape more text automatically (#2612) 

because we are using javascript to populate the messages list we need to
make sure all special chars are escaped or line feeds will cause
problems
This commit is contained in:
Mafoo 2017-05-30 20:44:51 +01:00 committed by FusionPBX
parent 3ce76d577c
commit c295bd25e1
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
resources/classes/messages.php
View File

@ -39,7 +39,7 @@ if (!class_exists('messages')) {
$message_mood = $_SESSION['message_mood'] ?: 'default';
$message_delay = $_SESSION['message_delay'];
$html .= "display_message('".$message_text."', '".$message_mood."'";
$html .= "display_message('".str_replace(array("\r\n", "\n", "\r"),'\\n', htmlspecialchars($message_text))."', '".$message_mood."'";
if ($message_delay != '') {
$html .= ", '".$message_delay."'";
}
@ -51,7 +51,7 @@ if (!class_exists('messages')) {
$message_mood = $message['mood'] ?: 'default';
$message_delay = $message['delay'];
$html .= "display_message('".$message_text."', '".$message_mood."'";
$html .= "display_message('".str_replace(array("\r\n", "\n", "\r"),'\\n', htmlspecialchars($message_text))."', '".$message_mood."'";
if ($message_delay != '') {
$html .= ", '".$message_delay."'";
}