fix(targetticket,targetchange): escape text fields of targets

Signed-off-by: Thierry Bugier <tbugier@teclib.com>
pluginsGLPI · Feb 3, 2020 · 559424e · 559424e
1 parent d4ca172
commit 559424e
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 0 deletions.
diff --git a/inc/targetchange.class.php b/inc/targetchange.class.php
@@ -171,6 +171,10 @@ public static function import(PluginFormcreatorLinker $linker, $input = [], $con
          );
       }
 
+      // Escape text fields
+      foreach (['target_name'] as $key) {
+         $input[$key] = $DB->escape($input[$key]);
+      }
 
       // Assume that all questions are already imported
       // convert question uuid into id

diff --git a/inc/targetticket.class.php b/inc/targetticket.class.php
@@ -897,6 +897,10 @@ public static function import(PluginFormcreatorLinker $linker, $input = [], $con
          );
       }
 
+      // Escape text fields
+      foreach (['target_name'] as $key) {
+         $input[$key] = $DB->escape($input[$key]);
+      }
 
       // Assume that all questions are already imported
       // convert question uuid into id