Merge branch '3.1' into 3.2

thorsten · Sep 2, 2023 · 04da53d · 04da53d
2 parents 5b4fc12 + 332d2e4
commit 04da53d
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/phpmyfaq/admin/api/configuration-list.php b/phpmyfaq/admin/api/configuration-list.php
@@ -22,6 +22,7 @@
 use phpMyFAQ\Helper\AdministrationHelper;
 use phpMyFAQ\Helper\LanguageHelper;
 use phpMyFAQ\Helper\PermissionHelper;
+use phpMyFAQ\Strings;
 use phpMyFAQ\System;
 use phpMyFAQ\Translation;
 use phpMyFAQ\Utils;
@@ -98,7 +99,7 @@ function renderInputForm(mixed $key, string $type): void
                 is_numeric($value) ? 'number' : $type,
                 $key,
                 $key,
-                $value
+                Strings::htmlentities($value)
             );
 
             if ('api.apiClientToken' === $key) {
@@ -147,7 +148,7 @@ function renderInputForm(mixed $key, string $type): void
             printf(
                 '<input class="form-control" type="password" autocomplete="off" name="edit[%s]" value="%s">',
                 $key,
-                $faqConfig->get($key)
+                Strings::htmlentities($faqConfig->get($key))
             );
             echo "</div>\n";
             break;

diff --git a/phpmyfaq/admin/api/user.php b/phpmyfaq/admin/api/user.php
@@ -75,6 +75,7 @@
             if (is_array($userdata)) {
                 $userdata['status'] = $user->getStatus();
                 $userdata['login'] = Strings::htmlentities($user->getLogin(), ENT_COMPAT);
+                $userdata['display_name'] = Strings::htmlentities($userdata['display_name'], ENT_COMPAT);
                 $userdata['is_superadmin'] = $user->isSuperAdmin();
                 $userdata['auth_source'] = $user->getUserAuthSource();
             } else {