fixed xss in timesheet description (#962)

2019-07-14 13:58:10 +02:00
parent e68b7da1f8
commit a0e8aa3a43
7 changed files with 7 additions and 7 deletions
--- a/templates/timesheet-team/export.html.twig
+++ b/templates/timesheet-team/export.html.twig
@@ -49,7 +49,7 @@
                        <td>
                            {% if entry.description is not empty %}
                            <div>
-                                {{ entry.description|desc2html }}
+                                {{ entry.description|escape|desc2html }}
                            </div>
                            {% endif %}
                            <span class="small">