From 57327b1488c437b210ef050a8bd82279c9003db8 Mon Sep 17 00:00:00 2001
From: Moritz Bunkus <m.bunkus@linet-services.de>
Date: Thu, 13 Jan 2011 15:17:10 +0100
Subject: [PATCH] Sonderzeichen in HTML-Ausgabe escapen
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

Fix für Bug 1555.
---
 templates/webpages/ic/assembly_row.html | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/templates/webpages/ic/assembly_row.html b/templates/webpages/ic/assembly_row.html
index c7f8d83d5..02a7804bb 100644
--- a/templates/webpages/ic/assembly_row.html
+++ b/templates/webpages/ic/assembly_row.html
@@ -1,5 +1,6 @@
 [%- USE T8 %]
 [%- USE LxERP %]
+[%- USE HTML %]
   <tr class=listheading>
    <th class=listheading>[% 'Individual Items' | $T8 %]</th>
   </tr>
@@ -19,7 +20,7 @@
       <td[% ' align=' _ rcol.align IF rcol.align %]>[%- rcol.data %]</td>
  [%- END %]
  [%- FOREACH hidden = row.hiddens %]
-      <input type=hidden name="[% hidden.name %]" value="[% hidden.value %]">
+      <input type=hidden name="[% HTML.escape(hidden.name) %]" value="[% HTML.escape(hidden.value) %]">
  [%- END %]
      </tr>
 [%- END %]
-- 
2.20.1