fixed xss in timesheet description (#962)

2019-07-14 13:58:10 +02:00
parent e68b7da1f8
commit a0e8aa3a43
7 changed files with 7 additions and 7 deletions
--- a/templates/invoice/index.html.twig
+++ b/templates/invoice/index.html.twig
@@ -56,7 +56,7 @@
                <td class="{{ tables.data_table_column_class(tableName, columns, 'user') }}">{{ widgets.label_user(entry.user) }}</td>
                <td class="{{ tables.data_table_column_class(tableName, columns, 'description') }} timesheet-description">
                    {% if entry.description is not empty %}
-                        {{ entry.description|desc2html }}
+                        {{ entry.description|escape|desc2html }}
                    {% else %}
                        {{ entry.activity.name }} / {{ entry.project.name }}
                    {% endif %}