From 81ccfc6f631270015f2ae11d4019c4b8b9ce7514 Mon Sep 17 00:00:00 2001
From: Ivan Kohler <ivan@freeside.biz>
Date: Thu, 9 Oct 2014 11:11:31 -0700
Subject: [PATCH] XSS

---
 httemplate/browse/part_event.html | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/httemplate/browse/part_event.html b/httemplate/browse/part_event.html
index ba036c8c6..d2e69460e 100644
--- a/httemplate/browse/part_event.html
+++ b/httemplate/browse/part_event.html
@@ -175,8 +175,10 @@ my $html_init =
   '&nbsp;or&nbsp;<SELECT NAME="clone"><OPTION></OPTION>';
 
 foreach my $part_event ( qsearch('part_event', {'disabled'=>''}) ) {
-  $html_init .=  '<OPTION VALUE="'. $part_event->eventpart. '">'.
-                  $part_event->eventpart. ': '. $part_event->event. '</OPTION>';
+  $html_init .= '<OPTION VALUE="'. $part_event->eventpart. '">'.
+                  $part_event->eventpart. ': '. 
+                  encode_entities($part_event->event).
+                '</OPTION>';
 }
 
 $html_init .= '</SELECT><INPUT TYPE="submit" VALUE="Clone existing event">'.
-- 
2.11.0