auch ids müssen in der Multibox escaped werden.

diff --git a/templates/webpages/generic/multibox.html b/templates/webpages/generic/multibox.html
index 7225b0347f14f340ea267f1bc0ceb6fd86bbd0d6..ccb87cb154e41c4b1330049ab83559f2b9a31990 100644 (file)
--- a/templates/webpages/generic/multibox.html
+++ b/templates/webpages/generic/multibox.html
@@ -62,7 +62,7 @@
   <option value=""></option>
   [%- END %]
   [%- FOREACH row = DATA %]
   <option value=""></option>
   [%- END %]
   [%- FOREACH row = DATA %]

-  <option value="[% row.id %]"[% IF row.selected %] selected[% END %]>[% HTML.escape(row.label) %]</option>
+  <option value="[% row.id | html %]"[% IF row.selected %] selected[% END %]>[% HTML.escape(row.label) %]</option>

   [%- END %]
 </select>
 [%- END %]
   [%- END %]
 </select>
 [%- END %]