From 000daf70ca8e3301b88be310949d4cd6cbadce4e Mon Sep 17 00:00:00 2001
From: Christian Weiske <cweiske@cweiske.de>
Date: Wed, 17 Aug 2011 18:24:26 +0200
Subject: Fix bug: Subtitle was not escaped

---
 data/templates/default/top.inc.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'data')

diff --git a/data/templates/default/top.inc.php b/data/templates/default/top.inc.php
index 17ec982..f2adba4 100644
--- a/data/templates/default/top.inc.php
+++ b/data/templates/default/top.inc.php
@@ -49,7 +49,7 @@ if(!isset($_GET['popup'])) {
 
 <?php
 if (isset($subtitle)) {
-	echo '<h2>'. $subtitle ."</h2>\n";
+	echo '<h2>'. htmlspecialchars($subtitle) ."</h2>\n";
 }
 if(DEBUG_MODE) {
 	echo '<p class="error">'. T_('Admins, your installation is in "Debug Mode" ($debugMode = true). To go in "Normal Mode" and hide debugging messages, change $debugMode to false into config.php.') ."</p>\n";
-- 
cgit v1.2.3