Encode $acomment

glpi-project · Sep 17, 2024 · 4997bef · cedric-anne · Sep 17, 2024 · 4997bef
1 parent 754cc04
commit 4997bef
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/DbUtils.php b/src/DbUtils.php
@@ -1501,7 +1501,7 @@ public function getTreeValueCompleteName($table, $ID, $withcomment = false, $tra
                         $acomment .= $country;
                     }
                     if (trim($acomment != '')) {
-                        $comment .= "<span class='b'>&nbsp;" . __s('Address:') . "</span> " . $acomment . "<br/>";
+                        $comment .= "<span class='b'>&nbsp;" . __s('Address:') . "</span> " . htmlspecialchars($acomment) . "<br/>";
                     }
                 }
                 $comment .= "<span class='b'>&nbsp;" . __s('Comments') . "&nbsp;</span>";