Correctly quote spell text contents inside the xml container

13 years ago · cbb695a6de
1 changed files with 1 additions and 1 deletions
--- a/program/lib/Roundcube/rcube_spellchecker.php
+++ b/program/lib/Roundcube/rcube_spellchecker.php
@ -354,7 +354,7 @@ class rcube_spellchecker

        $gtext = '<?xml version="1.0" encoding="utf-8" ?>'
            .'<spellrequest textalreadyclipped="0" ignoredups="0" ignoredigits="1" ignoreallcaps="1">'
-            .'<text>' . $gtext . '</text>'
+            .'<text>' . htmlspecialchars($gtext) . '</text>'
            .'</spellrequest>';

        $store = '';