Fixed bug #13961: XSS in impexp (thanks to Georg Ringer)
authorOliver Hader <oliver.hader@typo3.org>
Wed, 28 Jul 2010 08:56:14 +0000 (08:56 +0000)
committerOliver Hader <oliver.hader@typo3.org>
Wed, 28 Jul 2010 08:56:14 +0000 (08:56 +0000)
git-svn-id: https://svn.typo3.org/TYPO3v4/Core/trunk@8341 709f56b5-9817-0410-a4d7-c38de5d9e867

ChangeLog
typo3/sysext/impexp/app/index.php

index 1115ced..0598df3 100755 (executable)
--- a/ChangeLog
+++ b/ChangeLog
@@ -7,6 +7,7 @@
        * Fixed bug #11618: XSS vulnerability in install tool / BE login (thanks to Georg Ringer)
        * Fixed bug #14950: XSS in t3editor (thanks to Tobias Liebig)
        * Fixed bug #14850: Information disclosure in t3lib_htmlmail (thanks to Georg Ringer)
+       * Fixed bug #13961: XSS in impexp (thanks to Georg Ringer)
 
 2010-07-27  Steffen Kamper  <steffen@typo3.org>
 
index 23aa38a..aaa1cf3 100755 (executable)
@@ -1453,7 +1453,7 @@ class SC_mod_tools_log_index extends t3lib_SCbase {
                                        'preset_data' => serialize($inData)
                                );
                                $GLOBALS['TYPO3_DB']->exec_INSERTquery('tx_impexp_presets',$fields_values);
-                               $msg = 'New preset "'.$inData['preset']['title'].'" is created';
+                               $msg = 'New preset "' . htmlspecialchars($inData['preset']['title']) . '" is created';
                        }
                }