#2543 (ok 2.11.2)Browse Foreign Values - Return Values Not Escaped

[Alex Rambau]

When using the "browse foreign values" functionality of the application, incorrect return values are specified in the selection lists. For instance, the value (an Active Directory username) 'domain\bjones' is returned as 'domainjones'. Return values are not escaped.

[Alex Rambau]

Logged In: YES
user_id=1819775
Originator: YES

Lines 250 and 258 of browse_foreigners.php seem to be the issue. Adding function call to addslashes before htmlspecialchars seems to do the trick.

[Alex Rambau]

Patch against revision 10684

[Alex Rambau]

Logged In: YES
user_id=1819775
Originator: YES

File Added: browse_foreigners.diff

[Marc Delisle]

Logged In: YES
user_id=210714
Originator: NO

Fixed, thanks for the patch.