From 3ecda114c98e51ce43a812e319ede7c1e5f727d4 Mon Sep 17 00:00:00 2001
From: DamienLyon <renou.damien@gmail.com>
Date: Sun, 3 Nov 2024 09:47:01 +0100
Subject: [PATCH] Update new_ticket.php

Prevent cross site scripting
---
 public/main/ticket/new_ticket.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/public/main/ticket/new_ticket.php b/public/main/ticket/new_ticket.php
index 7456df4962..97a2ebfe55 100644
--- a/public/main/ticket/new_ticket.php
+++ b/public/main/ticket/new_ticket.php
@@ -24,7 +24,7 @@ function updateCourseList(sessionId) {
     }, function (courseList) {
         $("<option>", {
             value: 0,
-            text: "'.get_lang('Select').'"
+            text: '.json_encode(get_lang('Select')).'
         }).appendTo($selectCourse);
 
         if (courseList.length > 0) {
@@ -141,9 +141,9 @@ function save_ticket()
     $category_id = isset($_POST['category_id']) ? (int) $_POST['category_id'] : '';
 
     $project_id = (int) $_POST['project_id'];
-    $subject = $_POST['subject'];
+    $subject = Security::remove_XSS($_POST['subject']);
     $other_area = (int) $_POST['other_area'];
-    $personal_email = $_POST['personal_email'];
+    $personal_email = Security::remove_XSS($_POST['personal_email']);
     $source = (int) $_POST['source_id'];
     $user_id = isset($_POST['user_id']) ? (int) $_POST['user_id'] : null;
     $priority = isset($_POST['priority_id']) ? (int) $_POST['priority_id'] : '';