CVE-2023-1760: fix: added missing conversion to HTML entities · thorsten/phpMyFAQ@56295b5

@@ -17,6 +17,7 @@

namespace phpMyFAQ\Helper;

use phpMyFAQ\Strings;

use phpMyFAQ\User;

/**

@@ -58,7 +59,7 @@ public function getAllUserOptions(int $id = 1, bool $allowBlockedUsers = false):

'<option value="%d" %s>%s (%s)</option>’,

$userId,

(($userId === $id) ? ‘selected’ : ‘’),

$this->user->getUserData(‘display_name’),

Strings::htmlentities($this->user->getUserData(‘display_name’)),

$this->user->getLogin()

);

}