From cbb695a6de0f5cea9c78fc4bb700c0a6852f9a48 Mon Sep 17 00:00:00 2001
From: Thomas Bruederli <thomas@roundcube.net>
Date: Thu, 14 Feb 2013 23:23:51 +0100
Subject: Correctly quote spell text contents inside the xml container

---
 program/lib/Roundcube/rcube_spellchecker.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'program')

diff --git a/program/lib/Roundcube/rcube_spellchecker.php b/program/lib/Roundcube/rcube_spellchecker.php
index 3d4d3a3d6..d4f23d18a 100644
--- a/program/lib/Roundcube/rcube_spellchecker.php
+++ b/program/lib/Roundcube/rcube_spellchecker.php
@@ -354,7 +354,7 @@ class rcube_spellchecker
 
         $gtext = '<?xml version="1.0" encoding="utf-8" ?>'
             .'<spellrequest textalreadyclipped="0" ignoredups="0" ignoredigits="1" ignoreallcaps="1">'
-            .'<text>' . $gtext . '</text>'
+            .'<text>' . htmlspecialchars($gtext) . '</text>'
             .'</spellrequest>';
 
         $store = '';
-- 
cgit v1.2.3