From: Moritz Bunkus <m.bunkus@linet-services.de>
Date: Fri, 26 Sep 2008 08:35:33 +0000 (+0000)
Subject: Auch versteckte Variablen HTML-escapen.
X-Git-Tag: release-2.6.0beta2~254
X-Git-Url: http://wagnertech.de/git?a=commitdiff_plain;h=f25d9c857df997a05c27af74f68af445f97146be;p=kivitendo-erp.git

Auch versteckte Variablen HTML-escapen.
---

diff --git a/bin/mozilla/is.pl b/bin/mozilla/is.pl
index e7c5a44bf..857681543 100644
--- a/bin/mozilla/is.pl
+++ b/bin/mozilla/is.pl
@@ -637,10 +637,10 @@ sub form_header {
       <table>
         <tr>
           $customers
-          <input type="hidden" name="customer_klass" value="$form->{customer_klass}">
-          <input type="hidden" name="customer_id" value="$form->{customer_id}">
-          <input type="hidden" name="oldcustomer" value="$form->{oldcustomer}">
-          <input type="hidden" name="selectcustomer" value="$form->{selectcustomer}">
+          <input type="hidden" name="customer_klass" value="| . H($form->{customer_klass}) . qq|">
+          <input type="hidden" name="customer_id" value="| . H($form->{customer_id}) . qq|">
+          <input type="hidden" name="oldcustomer" value="| . H($form->{oldcustomer}) . qq|">
+          <input type="hidden" name="selectcustomer" value="| . H($form->{selectcustomer}) . qq|">
         </tr>
         $contact
         $shipto