diff options
| author | Georg Ehrke <ownclouddev@georgswebsite.de> | 2012-02-02 21:23:41 +0100 |
|---|---|---|
| committer | Georg Ehrke <ownclouddev@georgswebsite.de> | 2012-02-02 21:23:41 +0100 |
| commit | ab31a890b6049926f625f075874a86a6bf8e1019 (patch) | |
| tree | 66211434d6b4c259a84fc791e8d94f89135ced29 | |
| parent | bfa69c3e591e0c9f930af7948364e1aae4bdff8b (diff) | |
| download | nextcloud-server-ab31a890b6049926f625f075874a86a6bf8e1019.tar.gz nextcloud-server-ab31a890b6049926f625f075874a86a6bf8e1019.zip | |
use strip_tags for calendar names
| -rw-r--r-- | apps/calendar/ajax/createcalendar.php | 2 | ||||
| -rw-r--r-- | apps/calendar/ajax/updatecalendar.php | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/apps/calendar/ajax/createcalendar.php b/apps/calendar/ajax/createcalendar.php index 08bf7b4ee49..8d7b12f9b89 100644 --- a/apps/calendar/ajax/createcalendar.php +++ b/apps/calendar/ajax/createcalendar.php @@ -25,7 +25,7 @@ foreach($calendars as $cal){ } $userid = OC_User::getUser(); -$calendarid = OC_Calendar_Calendar::addCalendar($userid, htmlspecialchars($_POST['name']), 'VEVENT,VTODO,VJOURNAL', null, 0, $_POST['color']); +$calendarid = OC_Calendar_Calendar::addCalendar($userid, strip_tags($_POST['name']), 'VEVENT,VTODO,VJOURNAL', null, 0, $_POST['color']); OC_Calendar_Calendar::setCalendarActive($calendarid, 1); $calendar = OC_Calendar_Calendar::find($calendarid); diff --git a/apps/calendar/ajax/updatecalendar.php b/apps/calendar/ajax/updatecalendar.php index 90dafd35b68..5add6d92bfa 100644 --- a/apps/calendar/ajax/updatecalendar.php +++ b/apps/calendar/ajax/updatecalendar.php @@ -26,7 +26,7 @@ foreach($calendars as $cal){ $calendarid = $_POST['id']; $calendar = OC_Calendar_App::getCalendar($calendarid);//access check -OC_Calendar_Calendar::editCalendar($calendarid, htmlspecialchars($_POST['name']), null, null, null, $_POST['color']); +OC_Calendar_Calendar::editCalendar($calendarid, strip_tags($_POST['name']), null, null, null, $_POST['color']); OC_Calendar_Calendar::setCalendarActive($calendarid, $_POST['active']); $calendar = OC_Calendar_App::getCalendar($calendarid); |