aboutsummaryrefslogtreecommitdiffstats
path: root/template
diff options
context:
space:
mode:
authorFrédéric Buclin <LpSolit@gmail.com>2012-11-13 18:53:55 +0100
committerFrédéric Buclin <LpSolit@gmail.com>2012-11-13 18:53:55 +0100
commitaecf0a17d1689d957bc8854e55e499839798446f (patch)
tree8fa84413d8d053e609b5e4b192011f99808b01de /template
parent58f2aa2c8e2c87d17eef378f357ddd77ba60f1c0 (diff)
downloadbugs-aecf0a17d1689d957bc8854e55e499839798446f.tar
bugs-aecf0a17d1689d957bc8854e55e499839798446f.tar.gz
bugs-aecf0a17d1689d957bc8854e55e499839798446f.tar.bz2
bugs-aecf0a17d1689d957bc8854e55e499839798446f.tar.xz
bugs-aecf0a17d1689d957bc8854e55e499839798446f.zip
Bug 790296 (CVE-2012-4189): [SECURITY] Field values are not escaped correctly in tabular reports
r=dkl a=LpSolit
Diffstat (limited to 'template')
-rw-r--r--template/en/default/reports/report-table.html.tmpl2
1 files changed, 1 insertions, 1 deletions
diff --git a/template/en/default/reports/report-table.html.tmpl b/template/en/default/reports/report-table.html.tmpl
index 0e6193c25..466a87d9f 100644
--- a/template/en/default/reports/report-table.html.tmpl
+++ b/template/en/default/reports/report-table.html.tmpl
@@ -85,7 +85,7 @@ YAHOO.util.Event.addListener(window, "load", function() {
var myColumnDefs = [
{key:"row_title", label:"", sortable:true, sortOptions: { sortFunction:totalNumberSorter }},
[% FOREACH col = col_names %]
- {key:"[% col FILTER js %]", label:"[% display_value(col_field, col) FILTER js %]", sortable:true,
+ {key:"[% col FILTER js %]", label:"[% display_value(col_field, col) FILTER html FILTER js %]", sortable:true,
formatter:this.Linkify, sortOptions: { defaultDir: YAHOO.widget.DataTable.CLASS_DESC, sortFunction:totalNumberSorter }},
[% END %]
{key:"total", label:"Total", sortable:true, formatter:this.LinkifyTotal,