From 66b96e4440961483d026473fc6242599b3d51550 Mon Sep 17 00:00:00 2001
From: Thomas Tanghus <thomas@tanghus.net>
Date: Thu, 2 Feb 2012 16:46:38 +0100
Subject: Sanitize in- and output.

---
 apps/contacts/templates/part.property.FN.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'apps/contacts/templates/part.property.FN.php')

diff --git a/apps/contacts/templates/part.property.FN.php b/apps/contacts/templates/part.property.FN.php
index 83cef94e303..c9e21c20e60 100644
--- a/apps/contacts/templates/part.property.FN.php
+++ b/apps/contacts/templates/part.property.FN.php
@@ -1,9 +1,9 @@
 	<p id="contacts_details_name" class="contacts_property" data-checksum="<?php echo $_['property']['checksum']; ?>">
-		<?php echo $_['property']['value']; ?>
+		<?php echo htmlspecialchars($_['property']['value']); ?>
 		<span style="display:none;" data-use="edit"><img class="svg action" src="<?php echo image_path('', 'actions/rename.svg'); ?>" /></span>
 	</p>
 <?php if (!isset($_['details'])): ?>
 <script>
-$('#leftcontent li.active a').text('<?php echo $_['property']['value']; ?>');
+$('#leftcontent li.active a').text('<?php echo htmlspecialchars($_['property']['value']); ?>');
 </script>
 <?php endif ?>
-- 
cgit v1.2.3