Security: Remove on* attributes for input text fields

AngelFQC · AngelFQC · commit 241c569dde0a · 2024-12-02T13:32:07.000-05:00
Fix advisory GHSA-gw58-89f7-4xgj
diff --git a/main/inc/lib/formvalidator/FormValidator.class.php b/main/inc/lib/formvalidator/FormValidator.class.php
@@ -217,6 +217,8 @@ public function addText($name, $label, $required = true, $attributes = [], $crea
 
         $this->applyFilter($name, 'trim');
         $this->applyFilter($name, 'html_filter');
+        $this->applyFilter($name, 'attr_on_filter');
+
         if ($required) {
             $this->addRule($name, get_lang('ThisFieldIsRequired'), 'required');
         }

Original file line number	Diff line number	Diff line change
`@@ -217,6 +217,8 @@ public function addText($name, $label, $required = true, $attributes = [], $crea`
`217`	`217`
`218`	`218`	`$this->applyFilter($name, 'trim');`
`219`	`219`	`$this->applyFilter($name, 'html_filter');`
	`220`	`+ $this->applyFilter($name, 'attr_on_filter');`
	`221`	`+`
`220`	`222`	`if ($required) {`
`221`	`223`	`$this->addRule($name, get_lang('ThisFieldIsRequired'), 'required');`
`222`	`224`	`}`