Changeset 586 for trunk/Modules/Dictionary/Dictionary.php

Timestamp:

Oct 7, 2013, 11:52:11 PM (11 years ago)

Author:

chronos

Message:

• Fixed: SQL injection protection was not applied because of new dynamic URL handling.
• Fixed: HTML entities encodin for search input string.

File:

• trunk/Modules/Dictionary/Dictionary.php (modified) (1 diff)

trunk/Modules/Dictionary/Dictionary.php

@@ -213 +213 @@
        
   $Output .= '<tr><td>
-    <input type="text" value="'.$Search.'" name="search" size="30" />
+    <input type="text" value="'.htmlentities($Search).'" name="search" size="30" />
     <input type="submit" value="Vyhledat" />';
   if($this->System->User->Licence(LICENCE_USER))