Escape name in CommonDBTM

glpi-project · Sep 17, 2024 · 4e032b4 · 4e032b4
1 parent 7dbcba5
commit 4e032b4
Showing 1 changed file with 5 additions and 4 deletions.
diff --git a/src/CommonDBTM.php b/src/CommonDBTM.php
@@ -3668,30 +3668,31 @@ public function getName($options = [])
             if ($p['additional']) {
                 $pre = $this->getPreAdditionalInfosForName();
                 if (!empty($pre)) {
-                    $name = sprintf(__('%1$s - %2$s'), $pre, $name);
+                    return sprintf(__('%1$s - %2$s'), $pre, \htmlspecialchars($name));
                 }
                 $post = $this->getPostAdditionalInfosForName();
                 if (!empty($post)) {
-                    $name = sprintf(__('%1$s - %2$s'), $name, $post);
+                    return sprintf(__('%1$s - %2$s'), \htmlspecialchars($name), $post);
                 }
             }
             if ($p['comments']) {
                 $comment = $this->getComments();
                 if (!empty($comment)) {
-                    $name = sprintf(__('%1$s - %2$s'), $name, $comment);
+                    return sprintf(__('%1$s - %2$s'), \htmlspecialchars($name), $comment);
                 }
             }
 
             if ($p['icon']) {
                 $icon = $this->getIcon();
                 if (!empty($icon)) {
-                    $name = sprintf(
+                    return sprintf(
                         '<i class="%s"></i> %s',
                         htmlspecialchars($icon),
                         htmlspecialchars($name)
                     );
                 }
             }
+
             return $name;
         }
         return NOT_AVAILABLE;