read a widget optional parameter with " fix

jeedom · May 2, 2024 · 9af00e9 · 9af00e9
1 parent 8398043
commit 9af00e9
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 4 deletions.
diff --git a/desktop/modal/cmd.configure.php b/desktop/modal/cmd.configure.php
@@ -839,7 +839,7 @@
                     $tr .= '<input class="form-control key" value="' . $key . '" />';
                     $tr .= '</td>';
                     $tr .= '<td>';
-                    $tr .= '<input class="form-control value" value="' . $value . '" />';
+                    $tr .= '<input class="form-control value" value="' . htmlspecialchars($value, ENT_QUOTES) . '" />';
                     $tr .= '</td>';
                     $tr .= '<td>';
                     $tr .= '<a class="btn btn-danger btn-xs removeWidgetParameter pull-right"><i class="fas fa-times"></i> Supprimer</a>';

diff --git a/desktop/modal/eqLogic.configure.php b/desktop/modal/eqLogic.configure.php
@@ -318,7 +318,7 @@
                     $echo .= '<input class="form-control input-sm key" value="' . $key . '">';
                     $echo .= '</td>';
                     $echo .= '<td>';
-                    $echo .= '<input class="form-control input-sm value" value="' . $value . '">';
+                    $echo .= '<input class="form-control input-sm value" value="' . htmlspecialchars($value, ENT_QUOTES) . '">';
                     $echo .= '</td>';
                     $echo .= '<td class="text-right">';
                     $echo .= '<a class="btn btn-danger btn-xs removeWidgetParameter"><i class="far fa-trash-alt"></i> {{Supprimer}}</a>';

diff --git a/desktop/modal/eqLogic.dashboard.edit.php b/desktop/modal/eqLogic.dashboard.edit.php
@@ -213,7 +213,7 @@
                     $echo .= '<input class="form-control input-sm key" value="' . $key . '">';
                     $echo .= '</td>';
                     $echo .= '<td>';
-                    $echo .= '<input class="form-control input-sm value" value="' . $value . '">';
+                    $echo .= '<input class="form-control input-sm value" value="' . htmlspecialchars($value, ENT_QUOTES) . '">';
                     $echo .= '</td>';
                     $echo .= '<td class="text-right">';
                     $echo .= '<a class="btn btn-danger btn-xs removeTileParameter"><i class="far fa-trash-alt"></i></a>';
@@ -428,7 +428,7 @@
                 $display .= '<tr class="cmdoptparam text-center">';
                 $display .= '<td colspan="3">';
                 $display .= '<input class="key" value="' . $key . '" style="width:45%;">';
-                $display .= ' <input class="value" value="' . $value . '" style="width:45%;">';
+                $display .= ' <input class="value" value="' . htmlspecialchars($value, ENT_QUOTES) . '" style="width:45%;">';
                 $display .= '<a class="btn btn-danger btn-xs pull-right removeWidgetParameter"><i class="fas fa-trash-alt"></i></a>';
                 $display .= '</td>';
                 $display .= '</tr>';