Merge pull request from GHSA-gp6m-fq6h-cjcx

OpenMage · Feb 27, 2024 · 8d00914 · 8d00914
1 parent 63293af
commit 8d00914
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/app/code/core/Mage/Adminhtml/Block/System/Config/Form/Field/File.php b/app/code/core/Mage/Adminhtml/Block/System/Config/Form/Field/File.php
@@ -43,7 +43,7 @@ protected function _getDeleteCheckbox()
         $html = '';
         if ((string)$this->getValue()) {
             $label = Mage::helper('adminhtml')->__('Delete File');
-            $html .= '<div>' . $this->getValue() . ' ';
+            $html .= '<div>'. Mage::helper('adminhtml')->escapeHtml($this->getValue()) . ' ';
             $html .= '<input type="checkbox" name="' . parent::getName() . '[delete]" value="1" class="checkbox" id="' . $this->getHtmlId() . '_delete"' . ($this->getDisabled() ? ' disabled="disabled"' : '') . '/>';
             $html .= '<label for="' . $this->getHtmlId() . '_delete"' . ($this->getDisabled() ? ' class="disabled"' : '') . '> ' . $label . '</label>';
             $html .= '<input type="hidden" name="' . parent::getName() . '[value]" value="' . $this->getValue() . '" />';