Hello, I've noticed that form objects are not escaped in templates.
$this->form = new MyObjectForm(); # won't be escaped Other objects ARE escaped. $this->myObject = $this->form->getObject(); # will be escaped This can easily be checked using get_class() in a template. Anyone could explain this behaviour? Regards, Rytis -- If you want to report a vulnerability issue on symfony, please send it to security at symfony-project.com You received this message because you are subscribed to the Google Groups "symfony users" group. To post to this group, send email to symfony-users@googlegroups.com To unsubscribe from this group, send email to symfony-users+unsubscr...@googlegroups.com For more options, visit this group at http://groups.google.com/group/symfony-users?hl=en
