From 5012e90c3dcec9566b23ee93f71bf78a30c9f35d Mon Sep 17 00:00:00 2001
From: =?utf8?q?Bernd=20Ble=C3=9Fmann?= <bernd@kivitendo-premium.de>
Date: Wed, 29 Jan 2014 14:36:06 +0100
Subject: [PATCH] =?utf8?q?URLs=20f=C3=BCr=20Links=20im=20ReportGenerator?=
 =?utf8?q?=20richtig=20escapen.?=
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

---
 templates/webpages/report_generator/html_report.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/templates/webpages/report_generator/html_report.html b/templates/webpages/report_generator/html_report.html
index 71908655c..2b169ab36 100644
--- a/templates/webpages/report_generator/html_report.html
+++ b/templates/webpages/report_generator/html_report.html
@@ -35,7 +35,7 @@
      [%- IF col.align %] align="[% HTML.escape(col.align) %]" style="text-align: [% HTML.escape(col.align) %]"[% END -%]
      [%- IF col.colspan && col.colspan > 1 %] colspan="[% HTML.escape(col.colspan) %]"[% END -%]
      >
-      [%- IF col.link -%]<a class='report-generator-header-link' href="[% col.link %]">[%- END -%]
+      [%- IF col.link -%]<a class='report-generator-header-link' href="[% HTML.escape(col.link) %]">[%- END -%]
       [%- col.text -%]
       [%- IF col.show_sort_indicator -%]<img border="0" src="image/[% IF col.sort_indicator_direction %]down[% ELSE %]up[% END %].png">[%- END -%]
       [%- IF col.link -%]</a>[%- END -%]
@@ -63,7 +63,7 @@
        [%- ELSE %]
         [%- USE iterator(col.CELL_ROWS) %][%- FOREACH cell_row = iterator %]
          [%- IF cell_row.data != '' %]
-          [%- IF cell_row.link %]<a href="[% cell_row.link %]">[%- END %]
+          [%- IF cell_row.link %]<a href="[% HTML.escape(cell_row.link) %]">[%- END %]
           [%- cell_row.data %]
           [%- IF cell_row.link %]</a>[%- END %]
          [%- END %]
-- 
2.20.1