Quote variable in manage_tabs to avoid XSS.

From Products.PloneHotfix20160830.

Quote variable in manage_tabs to avoid XSS.
From Products.PloneHotfix20160830.
8aa8b081 · Maurits van Rees · 6ddbde03 · 8aa8b081 · 8aa8b081
Commit 8aa8b081 authored Sep 07, 2016 by Maurits van Rees
Hide whitespace changes
Inline Side-by-side

Showing with 4 additions and 1 deletion

CHANGES.rst CHANGES.rst +3 -0

src/App/dtml/manage_tabs.dtml src/App/dtml/manage_tabs.dtml +1 -1

No files found.
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -11,6 +11,9 @@ https://zope.readthedocs.io/en/2.13/CHANGES.html
 Bugs Fixed
 ++++++++++

+- Quote variable in manage_tabs to avoid XSS.
+  From Products.PloneHotfix20160830.  [maurits]
+
 - Remove more HelpSys references.

 Features Added

--- a/src/App/dtml/manage_tabs.dtml
+++ b/src/App/dtml/manage_tabs.dtml
@@ -97,7 +97,7 @@

 <dtml-if manage_tabs_message>
 <div class="system-msg">
-<dtml-var manage_tabs_message newline_to_br>
+<dtml-var manage_tabs_message newline_to_br html_quote>
 (<dtml-var ZopeTime fmt="%Y-%m-%d %H:%M">)
 </div>
 </dtml-if>