From: Stephan Großberndt Date: Sat, 16 Dec 2017 13:10:40 +0000 (+0100) Subject: [BUGFIX] Add missing htmlspecialchars() and cleanup in EXT:recordlist X-Git-Tag: v9.1.0~151 X-Git-Url: http://git.typo3.org/Packages/TYPO3.CMS.git/commitdiff_plain/ca91b4cff3cddf6da5d107f4a30efe2ab8d11b5c [BUGFIX] Add missing htmlspecialchars() and cleanup in EXT:recordlist Add missing htmlspecialchars() calls in EXT:recordlist and do cleanup. Resolves: #83358 Releases: master, 8.7 Change-Id: If441da15bd0b37ca94121b3787457dddde9380bf Reviewed-on: https://review.typo3.org/55117 Tested-by: TYPO3com Reviewed-by: Stefan Neufeind Reviewed-by: Anja Leichsenring Tested-by: Anja Leichsenring Reviewed-by: Benni Mack Tested-by: Benni Mack Tested-by: Stefan Neufeind --- diff --git a/typo3/sysext/recordlist/Classes/Controller/AbstractLinkBrowserController.php b/typo3/sysext/recordlist/Classes/Controller/AbstractLinkBrowserController.php index 08246c09409c..7cf137e0648d 100644 --- a/typo3/sysext/recordlist/Classes/Controller/AbstractLinkBrowserController.php +++ b/typo3/sysext/recordlist/Classes/Controller/AbstractLinkBrowserController.php @@ -171,14 +171,11 @@ abstract class AbstractLinkBrowserController $options = ''; foreach ($menuData as $id => $def) { - $class = $def['isActive'] ? 'active' : ''; - $label = $def['label']; - $url = htmlspecialchars($def['url']); - $params = $def['addParams']; - - $options .= '
  • ' . - '' . $label . '' . - '
  • '; + $class = $def['isActive'] ? ' class="active"' : ''; + + $options .= '' + . '' . htmlspecialchars($def['label']) . '' + . ''; } $content .= '