diff options
| author | alecpl <alec@alec.pl> | 2011-05-27 13:20:46 +0000 |
|---|---|---|
| committer | alecpl <alec@alec.pl> | 2011-05-27 13:20:46 +0000 |
| commit | 55150f858fc5b46eefed76687352283d4ef1503c (patch) | |
| tree | 5a6492974c0745c3a061ca56be5c7eb8b9c6c6fe | |
| parent | d9641b0874ae1c0344600c5566e0d1135bd7f0cd (diff) | |
- Fix handling of "<" character in group name
| -rw-r--r-- | program/steps/addressbook/groups.inc | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/program/steps/addressbook/groups.inc b/program/steps/addressbook/groups.inc index 4c70bf114..2517873ce 100644 --- a/program/steps/addressbook/groups.inc +++ b/program/steps/addressbook/groups.inc @@ -68,7 +68,7 @@ else if ($RCMAIL->action == 'group-delmembers') { } else if ($RCMAIL->action == 'group-create') { - if ($name = trim(get_input_value('_name', RCUBE_INPUT_POST))) { + if ($name = trim(get_input_value('_name', RCUBE_INPUT_POST, true))) { $plugin = $RCMAIL->plugins->exec_hook('group_create', array('name' => $name, 'source' => $source)); if (!$plugin['abort']) @@ -78,6 +78,7 @@ else if ($RCMAIL->action == 'group-create') { } if ($created && $OUTPUT->ajax_call) { + $created['name'] = Q($created['name']); $OUTPUT->show_message('groupcreated', 'confirmation'); $OUTPUT->command('insert_contact_group', array('source' => $source) + $created); } @@ -87,7 +88,7 @@ else if ($RCMAIL->action == 'group-create') { } else if ($RCMAIL->action == 'group-rename') { - if (($gid = get_input_value('_gid', RCUBE_INPUT_POST)) && ($name = trim(get_input_value('_name', RCUBE_INPUT_POST)))) { + if (($gid = get_input_value('_gid', RCUBE_INPUT_POST)) && ($name = trim(get_input_value('_name', RCUBE_INPUT_POST, true)))) { $plugin = $RCMAIL->plugins->exec_hook('group_rename', array('group_id' => $gid, 'name' => $name, 'source' => $source)); if (!$plugin['abort']) @@ -99,7 +100,7 @@ else if ($RCMAIL->action == 'group-rename') { if ($newname && $OUTPUT->ajax_call) { $OUTPUT->show_message('grouprenamed', 'confirmation'); $OUTPUT->command('update_contact_group', array( - 'source' => $source, 'id' => $gid, 'name' => $newname, 'newid' => $newgid)); + 'source' => $source, 'id' => $gid, 'name' => Q($newname), 'newid' => $newgid)); } else if (!$newname) $OUTPUT->show_message($plugin['message'] ? $plugin['message'] : 'errorsaving', 'error'); |