From: Michael Gapczynski <GapczynskiM@gmail.com>
Date: Sun, 13 May 2012 19:57:10 +0000 (-0400)
Subject: Sanitize search queries, thanks to Lukas Reschke
X-Git-Tag: v4.0.0RC2~85^2
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=198b73ddd11c722e199cb3008fa07751be66c488;p=nextcloud-server.git

Sanitize search queries, thanks to Lukas Reschke
---

diff --git a/core/templates/layout.user.php b/core/templates/layout.user.php
index b832ac2636f..e9d105ed043 100644
--- a/core/templates/layout.user.php
+++ b/core/templates/layout.user.php
@@ -30,7 +30,7 @@
 		<header><div id="header">
 			<a href="<?php echo link_to('', 'index.php'); ?>" title="" id="owncloud"><img class="svg" src="<?php echo image_path('', 'logo-wide.svg'); ?>" alt="ownCloud" /></a>
 			<form class="searchbox" action="#" method="post">
-				<input id="searchbox" class="svg" type="search" name="query" value="<?php if(isset($_POST['query'])){echo $_POST['query'];};?>" autocomplete="off" />
+				<input id="searchbox" class="svg" type="search" name="query" value="<?php if(isset($_POST['query'])){echo htmlentities($_POST['query']);};?>" autocomplete="off" />
 			</form>
 			<a id="logout" href="<?php echo link_to('', 'index.php'); ?>?logout=true"><img class="svg" alt="<?php echo $l->t('Log out');?>" title="<?php echo $l->t('Log out');?>" src="<?php echo image_path('', 'actions/logout.svg'); ?>" /></a>
 		</div></header>