diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php index 19d9c039736..43588ba0d0e 100644 --- a/htdocs/core/lib/functions.lib.php +++ b/htdocs/core/lib/functions.lib.php @@ -659,11 +659,11 @@ function checkVal($out = '', $check = 'alphanohtml', $filter = null, $options = break; case 'alpha': // No html and no " and no ../ case 'alphanohtml': // Recommended for most scalar parameters and search parameters - if (!is_array($out)) - { + if (!is_array($out)) { // '"' is dangerous because param in url can close the href= or src= and add javascript functions. // '../' is dangerous because it allows dir transversals $out = str_replace(array('"', '"', '../'), '', trim($out)); + // keep lines feed $out = dol_string_nohtmltag($out, 0); } break; diff --git a/htdocs/societe/card.php b/htdocs/societe/card.php index f16779148d3..ea560ae650b 100644 --- a/htdocs/societe/card.php +++ b/htdocs/societe/card.php @@ -1288,7 +1288,7 @@ if (is_object($objcanvas) && $objcanvas->displayCanvasExists($action)) print ''; print ''; print ''; print $form->widgetForTranslation("address", $object, $permissiontoadd, 'textarea', 'alphanohtml', 'quatrevingtpercent'); print ''; @@ -1889,7 +1889,7 @@ if (is_object($objcanvas) && $objcanvas->displayCanvasExists($action)) // Address print ''.$form->editfieldkey('Address', 'address', '', $object, 0).''; print ''; print $form->widgetForTranslation("address", $object, $permissiontoadd, 'textarea', 'alphanohtml', 'quatrevingtpercent'); print '';