diff --git a/htdocs/core/class/html.form.class.php b/htdocs/core/class/html.form.class.php index d70e9c32c0b..9b52fd0e497 100644 --- a/htdocs/core/class/html.form.class.php +++ b/htdocs/core/class/html.form.class.php @@ -3932,11 +3932,12 @@ class Form /** * Return a HTML select string, built from an array of key+value. + * Note: Do not use returned string into a langs->trans function, content may be entity encoded twice. * * @param string $htmlname Name of html select area * @param array $array Array with key+value * @param string $id Preselected key - * @param int $show_empty 1 si il faut ajouter une valeur vide dans la liste, 0 sinon + * @param int $show_empty 0 no empty value allowed, 1 to add an empty value into list (value is '' or ' '). * @param int $key_in_label 1 pour afficher la key dans la valeur "[key] value" * @param int $value_as_key 1 to use value as key * @param string $moreparam Add more parameters onto the select tag @@ -3945,7 +3946,7 @@ class Form * @param int $disabled Html select box is disabled * @param int $sort 'ASC' or 'DESC' =Sort on label, '' or 'NONE'=Do not sort * @param string $morecss Add more class to css styles - * @return string HTML select string + * @return string HTML select string. */ static function selectarray($htmlname, $array, $id='', $show_empty=0, $key_in_label=0, $value_as_key=0, $moreparam='', $translate=0, $maxlen=0, $disabled=0, $sort='', $morecss='') { @@ -3982,11 +3983,11 @@ class Form if ($key_in_label) { - $selectOptionValue = dol_htmlentitiesbr($key.' - '.($maxlen?dol_trunc($value,$maxlen):$value)); + $selectOptionValue = dol_escape_htmltag($key.' - '.($maxlen?dol_trunc($value,$maxlen):$value)); } else { - $selectOptionValue = dol_htmlentitiesbr($maxlen?dol_trunc($value,$maxlen):$value); + $selectOptionValue = dol_escape_htmltag($maxlen?dol_trunc($value,$maxlen):$value); if ($value == '' || $value == '-') $selectOptionValue=' '; } $out.=$selectOptionValue; diff --git a/htdocs/core/lib/ajax.lib.php b/htdocs/core/lib/ajax.lib.php index f91ec3d188d..673f64e6261 100644 --- a/htdocs/core/lib/ajax.lib.php +++ b/htdocs/core/lib/ajax.lib.php @@ -337,7 +337,7 @@ function ajax_combobox($htmlname, $events=array(), $minLengthToAutocomplete=0) width: "500px" */ $msg = '