From: Tom Needham <needham.thomas@gmail.com>
Date: Thu, 7 Jun 2012 17:43:26 +0000 (+0000)
Subject: Protect the help page
X-Git-Tag: v4.5.0beta1~74^2~423^2~7
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=1f409ec524c86570f8d4755f95789e1c0f149190;p=nextcloud-server.git

Protect the help page
---

diff --git a/settings/templates/help.php b/settings/templates/help.php
index a53ec76d681..cf61207e601 100644
--- a/settings/templates/help.php
+++ b/settings/templates/help.php
@@ -26,9 +26,9 @@
 	<?php foreach($_["kbe"] as $kb): ?>
 	<div class="helpblock">
 		<?php if($kb["preview1"] <> "") { echo('<img class="preview" src="'.$kb["preview1"].'" />'); } ?>
-		<?php if($kb['detailpage']<>'') echo('<p><a target="_blank" href="'.$kb['detailpage'].'"><strong>'.$kb["name"].'</strong></a></p>');?>
-		<p><?php echo $kb['description'];?></p>
-		<?php if($kb['answer']<>'') echo('<p><strong>'.$l->t('Answer').':</strong><p>'.$kb['answer'].'</p>');?>
+		<?php if($kb['detailpage']<>'') echo('<p><a target="_blank" href="'.$kb['detailpage'].'"><strong>'.htmlentities($kb["name"]).'</strong></a></p>');?>
+		<p><?php echo htmlentities($kb['description']);?></p>
+		<?php if($kb['answer']<>'') echo('<p><strong>'.$l->t('Answer').':</strong><p>'.htmlentities($kb['answer']).'</p>');?>
 	</div>
 	<?php endforeach;
 endif?>