Fixed reflective XSS in findResult.

This applies PloneHotfix20170117.

Fixed reflective XSS in findResult.
This applies PloneHotfix20170117.
812c4176 · Maurits van Rees · 15d1440b · 812c4176 · 812c4176
Commit 812c4176 authored Jan 17, 2017 by Maurits van Rees
Hide whitespace changes
Inline Side-by-side

Showing with 4 additions and 1 deletion

CHANGES.rst CHANGES.rst +3 -0

src/OFS/dtml/findResult.dtml src/OFS/dtml/findResult.dtml +1 -1

No files found.
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -11,6 +11,9 @@ https://zope.readthedocs.io/en/2.13/CHANGES.html
 Bugs Fixed
 ++++++++++

+- Fixed reflective XSS in findResult.
+  This applies PloneHotfix20170117.  [maurits]
+
 - Patch zope.interface to remove docstrings and avoid publishing.
  From Products.PloneHotfix20161129.   [maurits]


--- a/src/OFS/dtml/findResult.dtml
+++ b/src/OFS/dtml/findResult.dtml
@@ -124,7 +124,7 @@ your search terms below.
  </div>
  </TD>
  <TD ALIGN="LEFT" VALIGN="TOP">
-  <INPUT TYPE="TEXT" NAME="obj_ids:tokens" SIZE="30" VALUE="<dtml-var "' '.join(obj_ids or [])">">
+  <INPUT TYPE="TEXT" NAME="obj_ids:tokens" SIZE="30" VALUE="<dtml-var "' '.join(obj_ids or [])" html_quote>">
  </TD>
 </TR>