Wavyzz/dolibarr-fork
2
0
Fork 0
forked from Wavyzz/dolibarr
Code Pull Requests Activity

Code comment

Browse Source
This commit is contained in:
Laurent Destailleur
2021-01-15 19:24:53 +01:00
parent 80ed651c5e
commit d36c406074
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
htdocs/core/lib/functions.lib.php
View File

@@ -686,7 +686,7 @@ function checkVal($out = '', $check = 'alphanohtml', $filter = null, $options =
$out = dol_string_nohtmltag($out, 0); $out = dol_string_nohtmltag($out, 0);
} }
break; break;
case 'alphawithlgt': // No " and no ../ but we keep < > tags case 'alphawithlgt': // No " and no ../ but we keep < > tags. Can be used for email string like "Name <email>"
if (!is_array($out)) { if (!is_array($out)) {
// '"' is dangerous because param in url can close the href= or src= and add javascript functions. // '"' is dangerous because param in url can close the href= or src= and add javascript functions.
// '../' is dangerous because it allows dir transversals // '../' is dangerous because it allows dir transversals