Fixes #303: Escape html special chars when updating time entries (#304)

daften · web-flow · commit 1e2699bee313 · 2022-01-13T13:59:03.000+01:00
diff --git a/src/Redmine/Api/TimeEntry.php b/src/Redmine/Api/TimeEntry.php
@@ -114,7 +114,7 @@ public function update($id, array $params)
             if ('custom_fields' === $k && is_array($v)) {
                 $this->attachCustomFieldXML($xml, $v);
             } else {
-                $xml->addChild($k, $v);
+                $xml->addChild($k, htmlspecialchars($v));
             }
         }
 

Original file line number	Diff line number	Diff line change
`@@ -114,7 +114,7 @@ public function update($id, array $params)`
`114`	`114`	`if ('custom_fields' === $k && is_array($v)) {`
`115`	`115`	`$this->attachCustomFieldXML($xml, $v);`
`116`	`116`	`} else {`
`117`		`- $xml->addChild($k, $v);`
	`117`	`+ $xml->addChild($k, htmlspecialchars($v));`
`118`	`118`	`}`
`119`	`119`	`}`
`120`	`120`