From 98f7fc85f480f80bb8d7f7439a9ce6a697708823 Mon Sep 17 00:00:00 2001
From: Uwe Steinmann <steinm@debian.org>
Date: Fri, 30 Apr 2021 09:27:59 +0200
Subject: [PATCH] run htmlspecialchars on workflow names

---
 views/bootstrap/class.ViewDocument.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/views/bootstrap/class.ViewDocument.php b/views/bootstrap/class.ViewDocument.php
index 7a2bfe603..479f68198 100644
--- a/views/bootstrap/class.ViewDocument.php
+++ b/views/bootstrap/class.ViewDocument.php
@@ -1159,7 +1159,7 @@ class SeedDMS_View_ViewDocument extends SeedDMS_Theme_Style {
 					echo "<form class=\"form-inline\" action=\"../out/out.RunSubWorkflow.php\" method=\"get\"><input type=\"hidden\" name=\"documentid\" value=\"".$latestContent->getDocument()->getId()."\" /><input type=\"hidden\" name=\"version\" value=\"".$latestContent->getVersion()."\" />";
 					echo "<select name=\"subworkflow\" class=\"form-control\">";
 					foreach($subworkflows as $subworkflow) {
-						echo "<option value=\"".$subworkflow->getID()."\">".$subworkflow->getName()."</option>";
+						echo "<option value=\"".$subworkflow->getID()."\">".htmlspecialchars($subworkflow->getName())."</option>";
 					}
 					echo "</select>";
 					echo "<label class=\"inline\">";
@@ -1178,7 +1178,7 @@ class SeedDMS_View_ViewDocument extends SeedDMS_Theme_Style {
 					 * parent workflow
 					 */
 					if($latestContent->getWorkflowState()->getID() == $state->getID()) {
-						echo "Switching from sub workflow '".$workflow->getName()."' into state ".$state->getName()." of parent workflow '".$parentworkflow->getName()."' is possible<br />";
+						echo "Switching from sub workflow '".htmlspecialchars($workflow->getName())."' into state ".$state->getName()." of parent workflow '".htmlspecialchars($parentworkflow->getName())."' is possible<br />";
 						/* Check if the transition from the state where the sub workflow
 						 * starts into the current state is also allowed in the parent
 						 * workflow. Checking at this point is actually too late, because