Escape variables in landingpage module

midasplatform · Dec 8, 2014 · 9148049 · 9148049
1 parent c8c82e3
commit 9148049
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/modules/landingpage/controllers/IndexCoreController.php b/modules/landingpage/controllers/IndexCoreController.php
@@ -37,7 +37,7 @@ public function indexAction()
         $textDaos = $this->Landingpage_Text->getAll();
         if (isset($textDaos[0])) {
             $textDao = $textDaos[0];
-            $this->view->landingText = UtilityComponent::markdown($textDao->getText());
+            $this->view->landingText = UtilityComponent::markdown(htmlspecialchars($textDao->getText(), ENT_QUOTES, 'UTF-8'));
         } else {
             $this->callCoreAction();
         }