From b697da739963d3e78b3ad4f307b96cf79c7597dc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rapha=C3=ABl=20Doursenaud?= Date: Fri, 17 Feb 2017 16:16:41 +0100 Subject: [PATCH] Fix: [Payments] Properly escape variable for JS The company name may contain reserved characters such as a quote which needs proper escaping to prevent upsetting the JavaScript interpreter. --- htdocs/compta/paiement.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/htdocs/compta/paiement.php b/htdocs/compta/paiement.php index 4c2ed3b1aaa..e81d0e38345 100644 --- a/htdocs/compta/paiement.php +++ b/htdocs/compta/paiement.php @@ -369,7 +369,7 @@ if ($action == 'create' || $action == 'confirm_paiement' || $action == 'add_paie } if ($(\'#fieldchqemetteur\').val() == \'\') { - var emetteur = ('.$facture->type.' == 2) ? \''.dol_escape_htmltag($conf->global->MAIN_INFO_SOCIETE_NOM).'\' : jQuery(\'#thirdpartylabel\').val(); + var emetteur = ('.$facture->type.' == 2) ? \''.dol_escape_js(dol_escape_htmltag($conf->global->MAIN_INFO_SOCIETE_NOM)).'\' : jQuery(\'#thirdpartylabel\').val(); $(\'#fieldchqemetteur\').val(emetteur); } }