fixed xss in timesheet description (#962)

2019-07-14 13:58:10 +02:00
parent e68b7da1f8
commit a0e8aa3a43
7 changed files with 7 additions and 7 deletions
--- a/templates/export/renderer/pdf.html.twig
+++ b/templates/export/renderer/pdf.html.twig
@@ -151,7 +151,7 @@ mpdf-->
                {{ entry.project.customer.name }} - {{ entry.project.name }} - {{ entry.activity.name }}
                {% if entry.description is not empty %}
                    <br>
-                    <i>{{ entry.description|desc2html }}</i>
+                    <i>{{ entry.description|escape|desc2html }}</i>
                {% endif %}
            </td>
            <td class="duration">{{ entry.duration|duration }}</td>