From 94c201f265c758fad38eb69c0a5878970119197a Mon Sep 17 00:00:00 2001
From: Andy Staudacher <andy.st@gmail.com>
Date: Tue, 1 Sep 2009 01:17:39 -0700
Subject: XSS escape in form helper and forge where missing.

---
 modules/forge/libraries/Form_Checklist.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'modules/forge/libraries/Form_Checklist.php')

diff --git a/modules/forge/libraries/Form_Checklist.php b/modules/forge/libraries/Form_Checklist.php
index 99b455bd..4536d396 100644
--- a/modules/forge/libraries/Form_Checklist.php
+++ b/modules/forge/libraries/Form_Checklist.php
@@ -67,7 +67,7 @@ class Form_Checklist_Core extends Form_Input {
 			$data['value']   = $val;
 			$data['checked'] = $checked;
 
-			$checklist .= '<li><label>'.form::checkbox($data).' '.$title.'</label></li>'.$nl;
+			$checklist .= '<li><label>'.form::checkbox($data).' '.html::purify($title).'</label></li>'.$nl;
 		}
 		$checklist .= '</ul>';
 
-- 
cgit v1.2.3