LTI: HTML escaping in titles

Added htmlspecialchars in ilLTIConsumeProvider::assignFromDbRow
surlabs · Dec 9, 2024 · 08d7ad7 · 08d7ad7
1 parent 5bfbcb7
commit 08d7ad7
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/Modules/LTIConsumer/classes/class.ilLTIConsumeProvider.php b/Modules/LTIConsumer/classes/class.ilLTIConsumeProvider.php
@@ -807,7 +807,7 @@ public function assignFromDbRow(array $dbRow): void
             switch ($field) {
                 case 'id': $this->setId((int) $value);
                     break;
-                case 'title': $this->setTitle($value);
+                case 'title': $this->setTitle(htmlspecialchars($value));
                     break;
                 case 'description': $this->setDescription($value);
                     break;