Properly escape contents of PMs in the inbox.
Patch by exor674.
diffs (18 lines):
diff -r 1ea657a66375 -r fd11f5ad7f30 htdocs/inbox/compose.bml
--- a/htdocs/inbox/compose.bml Sun Sep 13 12:21:01 2009 +0800
+++ b/htdocs/inbox/compose.bml Sun Sep 13 04:29:21 2009 +0000
@@ -252,12 +252,12 @@ body<=
name => 'msg_subject',
size => '50',
value => $POST{'msg_subject'} || $msg_subject,
- class => 'subj-t'
+ class => 'subj-t'
});
$body .= "</p>\n";
$body .= "<div class='msg_txt'>";
$body .= "<textarea name='msg_body' rows=6 cols=55 wrap=soft>";
- $body .= $POST{'msg_body'} || $msg_body;
+ $body .= LJ::ehtml( $POST{'msg_body'} || $msg_body );
$body .= "</textarea><br />";
$body .= "<span class='helper'>Up to " . LJ::commafy($msg_limit) . "
characters. Plain text, no HTML.";
$body .= "</span></div>\n";
_______________________________________________
dw-changelog mailing list
[email protected]
http://lists.dwscoalition.org/mailman/listinfo/dw-changelog
