浏览代码

Fix: [Payments] Properly escape variable for JS

The company name may contain reserved characters such as a quote
which needs proper escaping to prevent upsetting the JavaScript
interpreter.
Raphaël Doursenaud 8 年之前
父节点
当前提交
b697da7399
共有 1 个文件被更改,包括 1 次插入1 次删除
  1. 1 1
      htdocs/compta/paiement.php

+ 1 - 1
htdocs/compta/paiement.php

@@ -369,7 +369,7 @@ if ($action == 'create' || $action == 'confirm_paiement' || $action == 'add_paie
 			                    }
             					if ($(\'#fieldchqemetteur\').val() == \'\')
             					{
-            						var emetteur = ('.$facture->type.' == 2) ? \''.dol_escape_htmltag($conf->global->MAIN_INFO_SOCIETE_NOM).'\' : jQuery(\'#thirdpartylabel\').val();
+            						var emetteur = ('.$facture->type.' == 2) ? \''.dol_escape_js(dol_escape_htmltag($conf->global->MAIN_INFO_SOCIETE_NOM)).'\' : jQuery(\'#thirdpartylabel\').val();
             						$(\'#fieldchqemetteur\').val(emetteur);
             					}
             				}