fix(itilsolution): sanitize content from twig renderer

glpi-project · Nov 3, 2022 · 67ad1d1 · 67ad1d1
1 parent 0435326
commit 67ad1d1
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 3 deletions.
diff --git a/src/ITILSolution.php b/src/ITILSolution.php
@@ -269,7 +269,7 @@ public function prepareInputForAdd($input)
                 return false;
             }
 
-            $input['content'] = $html;
+            $input['content'] = Sanitizer::sanitize($html);
         }
 
         return $input;

diff --git a/src/PendingReasonCron.php b/src/PendingReasonCron.php
@@ -33,6 +33,8 @@
  * ---------------------------------------------------------------------
  */
 
+use Glpi\Toolbox\Sanitizer;
+
 /**
  * @since 10.0.0
  */
@@ -155,7 +157,7 @@ public static function cronPendingreason_autobump_autosolve(CronTask $task)
                     'itemtype' => $item::getType(),
                     'items_id' => $item->getID(),
                     'users_id' => $config['system_user'],
-                    'content' => addslashes($fup_template->getRenderedContent($item)),
+                    'content' => Sanitizer::sanitize($fup_template->getRenderedContent($item)),
                     'is_private' => $fup_template->fields['is_private'],
                     'requesttypes_id' => $fup_template->fields['requesttypes_id'],
                     'timeline_position' => CommonITILObject::TIMELINE_RIGHT,
@@ -182,7 +184,7 @@ public static function cronPendingreason_autobump_autosolve(CronTask $task)
                     'itemtype'         => $item::getType(),
                     'items_id'         => $item->getID(),
                     'solutiontypes_id' => $solution_template->fields['solutiontypes_id'],
-                    'content'          => addslashes($solution_template->getRenderedContent($item)),
+                    'content'          => Sanitizer::sanitize($solution_template->getRenderedContent($item)),
                     'users_id'         => $config['system_user'],
                 ]);
                 $task->addVolume(1);