Merge pull request osTicket#5152 from JediKev/issue/format-file-name

issue: Format File Name
jezuk · Nov 8, 2019 · ed8b9cd · ed8b9cd
2 parents cca97ed + bd427cd
commit ed8b9cd
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/include/api.tickets.php b/include/api.tickets.php
@@ -93,7 +93,7 @@ function validate(&$data, $format, $strict=true) {
                 catch (FileUploadError $ex) {
                     $name = $file['name'];
                     $file = array();
-                    $file['error'] = $name . ': ' . $ex->getMessage();
+                    $file['error'] = Format::htmlchars($name) . ': ' . $ex->getMessage();
                 }
             }
             unset($file);

diff --git a/include/class.mailfetch.php b/include/class.mailfetch.php
@@ -847,7 +847,7 @@ function createTicket($mid) {
                 catch (FileUploadError $ex) {
                     $name = $file['name'];
                     $file = array();
-                    $file['error'] = $name . ': ' . $ex->getMessage();
+                    $file['error'] = Format::htmlchars($name) . ': ' . $ex->getMessage();
                 }
 
                 $vars['attachments'][] = $file;