from
<?php $vars['exposed_filters'][$filter] = $value;?>
to
<?php $vars['exposed_filters'][$filter] = check_plain($value);?>

Comments

joetsuihk’s picture

joetsuihk commented

the reason is, $view->exposed_input do not escape anything, any html tags inputed, see http://drupal.org/node/1053920

drumm’s picture

drumm
he/him
Location NY, US
commented
Issue summary: View changes
Status: Active » Fixed

This was fixed by https://www.drupal.org/forum/newsletters/security-advisories-for-contrib...

Please report potential security issues confidentially in the future.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.