From bd5dfe7e4cb5b53528e3aab2d3929452f6f1c63b Mon Sep 17 00:00:00 2001
From: alex <karpen_ko@hotmail.com>
Date: Tue, 23 Jan 2018 09:41:41 +0100
Subject: [PATCH] escaped HTML chars entered in textfields

---
 application/views/system/infocenter/infocenterDetails.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/application/views/system/infocenter/infocenterDetails.php b/application/views/system/infocenter/infocenterDetails.php
index 33da36af3..6d503b7fc 100644
--- a/application/views/system/infocenter/infocenterDetails.php
+++ b/application/views/system/infocenter/infocenterDetails.php
@@ -305,7 +305,7 @@ $this->load->view('templates/FHC-Header', array('title' => 'InfocenterDetails',
 																<div class="form-group">
 																	<label>ZGV Ort: </label>
 																	<?php if ($infoonly):
-																		echo $zgvpruefung->zgvort;
+																		echo html_escape($zgvpruefung->zgvort);
 																	else:
 																		?>
 																		<input type="text" class="form-control"
@@ -589,7 +589,7 @@ $this->load->view('templates/FHC-Header', array('title' => 'InfocenterDetails',
 												<tr data-toggle="tooltip"
 													title="<?php echo isset($notiz->text) ? $notiz->text : '' ?>">
 													<td><?php echo date_format(date_create($notiz->insertamum), 'd.m.Y H:i:s') ?></td>
-													<td><?php echo $notiz->titel ?></td>
+													<td><?php echo html_escape($notiz->titel) ?></td>
 													<td><?php echo $notiz->verfasser_uid ?></td>
 												</tr>
 											<?php endforeach ?>