+2007-02-27 Oliver Hader <oh@inpublica.de>
+
+ * Fixed bug: #5052: Form action URL is not htmlspecialchared (patch by Michael Stucki)
2007-02-27 Martin Kutschker <martin.t.kutschker@blackbox.net>
$html = $this->cObj->substituteSubpart($html, '###ADDITONAL_KEYWORD###', '');
}
- $markerArray['###ACTION_URL###'] = $this->pi_getPageLink($GLOBALS['TSFE']->id, $GLOBALS['TSFE']->sPre);
+ $markerArray['###ACTION_URL###'] = htmlspecialchars($this->pi_getPageLink($GLOBALS['TSFE']->id, $GLOBALS['TSFE']->sPre));
$hiddenFieldCode = $this->cObj->getSubpart($this->templateCode, '###HIDDEN_FIELDS###');
$hiddenFieldCode = preg_replace('/^\n\t(.+)/ms', '$1', $hiddenFieldCode); // Remove first newline and tab (cosmetical issue)