From: Ivan Kohler <ivan@freeside.biz>
Date: Thu, 9 Oct 2014 18:11:31 +0000 (-0700)
Subject: XSS
X-Git-Url: http://git.freeside.biz/gitweb/?p=freeside.git;a=commitdiff_plain;h=81ccfc6f631270015f2ae11d4019c4b8b9ce7514

XSS
---

diff --git a/httemplate/browse/part_event.html b/httemplate/browse/part_event.html
index ba036c8c6..d2e69460e 100644
--- a/httemplate/browse/part_event.html
+++ b/httemplate/browse/part_event.html
@@ -175,8 +175,10 @@ my $html_init =
   '&nbsp;or&nbsp;<SELECT NAME="clone"><OPTION></OPTION>';
 
 foreach my $part_event ( qsearch('part_event', {'disabled'=>''}) ) {
-  $html_init .=  '<OPTION VALUE="'. $part_event->eventpart. '">'.
-                  $part_event->eventpart. ': '. $part_event->event. '</OPTION>';
+  $html_init .= '<OPTION VALUE="'. $part_event->eventpart. '">'.
+                  $part_event->eventpart. ': '. 
+                  encode_entities($part_event->event).
+                '</OPTION>';
 }
 
 $html_init .= '</SELECT><INPUT TYPE="submit" VALUE="Clone existing event">'.