Fix missing HTML escapes for select option

This commit is contained in:
iliajie
2023-05-15 18:47:33 +03:00
parent cf9e00060b
commit 04d75bc526

View File

@@ -996,13 +996,13 @@ foreach $o (@$opts) {
$o = [ $o ] if (!ref($o));
$rv .= "<option value=\"".&quote_escape($o->[0])."\"".
($sel{$o->[0]} ? " selected" : "").($o->[2] ne '' ? " ".$o->[2] : "").">".
($o->[1] || $o->[0])."</option>\n";
&html_escape($o->[1] || $o->[0])."</option>\n";
$opt{$o->[0]}++;
}
foreach $s (keys %sel) {
if (!$opt{$s} && $missing) {
$rv .= "<option value=\"".&quote_escape($s)."\"".
" selected>".($s eq "" ? "&nbsp;" : $s)."</option>\n";
" selected>".($s eq "" ? "&nbsp;" : &html_escape($s))."</option>\n";
}
}
$rv .= "</select>\n";