From 0be40d61c86b409aa9ecfde50d2c103af4b021c7 Mon Sep 17 00:00:00 2001
From: Uwe Steinmann <steinm@debian.org>
Date: Wed, 26 Feb 2014 22:42:26 +0100
Subject: [PATCH] fix vulnerablity against xss attack

---
 views/bootstrap/class.Search.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/views/bootstrap/class.Search.php b/views/bootstrap/class.Search.php
index 5cd049654..7e2ceb894 100644
--- a/views/bootstrap/class.Search.php
+++ b/views/bootstrap/class.Search.php
@@ -110,7 +110,7 @@ class SeedDMS_View_Search extends SeedDMS_Bootstrap_Style {
 <tr>
 <td><?php printMLText("search_query");?>:</td>
 <td>
-<input type="text" name="query" value="<?php echo $this->query; ?>" />
+<input type="text" name="query" value="<?php echo htmlspecialchars($this->query); ?>" />
 <select name="mode">
 <option value="1" <?php echo ($mode=='AND') ? "selected" : ""; ?>><?php printMLText("search_mode_and");?>
 <option value="0"<?php echo ($mode=='OR') ? "selected" : ""; ?>><?php printMLText("search_mode_or");?>
@@ -246,7 +246,7 @@ class SeedDMS_View_Search extends SeedDMS_Bootstrap_Style {
 <tr>
 <td><?php printMLText("search_query");?>:</td>
 <td>
-<input type="text" name="query" value="<?php echo $this->query; ?>" />
+<input type="text" name="query" value="<?php echo htmlspecialchars($this->query); ?>" />
 <!--
 <select name="mode">
 <option value="1" selected><?php printMLText("search_mode_and");?>