lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix regression

Browse Source
This commit is contained in:
Laurent Destailleur 2023-04-28 18:44:08 +02:00
parent e74c50aa8a
commit 3b7e864b83
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
htdocs/admin/mails_templates.php
View File

@ -463,10 +463,10 @@ if (empty($reshook)) {
$_POST['joinfiles'] = GETPOST('joinfiles-'.$rowid); $_POST['joinfiles'] = GETPOST('joinfiles-'.$rowid);
} }
if ($field == 'content') { if ($field == 'content') {
$_POST['content'] = GETPOST('content-'.$rowid); $_POST['content'] = GETPOST('content-'.$rowid, 'restricthtml');
} }
if ($field == 'content_lines') { if ($field == 'content_lines') {
$_POST['content_lines'] = GETPOST('content_lines-'.$rowid); $_POST['content_lines'] = GETPOST('content_lines-'.$rowid, 'restricthtml');
} }
if ($i) { if ($i) {
@ -494,7 +494,7 @@ if (empty($reshook)) {
$i++; $i++;
} }
$sql .= " WHERE ".$rowidcol." = ".((int) $rowid); $sql .= " WHERE ".$db->escape($rowidcol)." = ".((int) $rowid);
if (!$user->admin) { // A non admin user can only edit its own template if (!$user->admin) { // A non admin user can only edit its own template
$sql .= " AND fk_user = ".((int) $user->id); $sql .= " AND fk_user = ".((int) $user->id);
} }