Fixed problem with ' " in title or value of checkboxes or regexes

git-svn-id: https://oss.gonicus.de/repositories/gosa/trunk@5216 594d385d-05f5-0310-b6e9-bd551577e9d8

diff --git a/include/class_MultiSelectWindow.inc b/include/class_MultiSelectWindow.inc
index bbba65eeeaf44d469bd63722a0e49c08779e8171..cf90a8d01284605c60424d83be2aa24e1a46d768 100644 (file)
--- a/include/class_MultiSelectWindow.inc
+++ b/include/class_MultiSelectWindow.inc
@@ -273,9 +273,9 @@ class MultiSelectWindow{
 
                        /* Check if box is checked */
                        if($box['default'] == true){
-                               $boxes .="<input type='checkbox' name='".$box['name']."' value='1' title='".$box['value']."' checked ".$boxClick.">&nbsp;".$box['string']."<br>";
+                               $boxes .="<input type='checkbox' name=\"".$box['name']."\" value='1' title=\"".htmlentities($box['value'])."\" checked ".$boxClick.">&nbsp;".$box['string']."<br>";
                        }else{
-                               $boxes .="<input type='checkbox' name='".$box['name']."' value='1' title='".$box['value']."'".$boxClick.">&nbsp;".$box['string']."<br>";
+                               $boxes .="<input type='checkbox' name=\"".$box['name']."\" value='1' title=\"".htmlentities($box['value'])."\" ".$boxClick.">&nbsp;".$box['string']."<br>";
                        }
                }
                $smarty->assign("CheckBoxes", $boxes);
@@ -292,8 +292,8 @@ class MultiSelectWindow{
                                </label>
                                </td>
                                <td width=\"99%\">
-                               <input type='text' style='width:99%' name='".$regex['name']."' maxlength='20'
-                               value='".$regex['value']."' title=\"".$regex['string']."\"> 
+                               <input type=\"text\" style='width:99%' name=\"".$regex['name']."\" maxlength='20'
+                               value=\"".htmlentities($regex['value'])."\" title=\"".htmlentities($regex['string'])."\"> 
                                </td>
                                </tr>
                                </table>";