Merge pull request #79 from forkcms/fix-spoon-form-attributes-xss

Fix xss issue with form attributes
forkcms · Feb 18, 2021 · 8ea8134 · 8ea8134
2 parents e86d149 + b27d38b
commit 8ea8134
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/spoon/form/attributes.php b/spoon/form/attributes.php
@@ -75,7 +75,7 @@ protected function getAttributesHTML(array $variables)
 			else
 			{
 				$html .= ' ' . $key;
-				if($value !== null) $html .= '="' . str_replace(array_keys($variables), array_values($variables), $value) . '"';
+				if($value !== null) $html .= '="' . Spoonfilter::htmlSpecialChars(str_replace(array_keys($variables), array_values($variables), $value)) . '"';
 			}
 		}