From 67463061634791213d699bfee92e88dac96b1034 Mon Sep 17 00:00:00 2001
From: Julio Montoya <gugli100@gmail.com>
Date: Thu, 19 Dec 2013 12:56:25 +0100
Subject: [PATCH] Fixing message see BT#7137

---
 main/work/add_document.php | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/main/work/add_document.php b/main/work/add_document.php
index 3693d78251..2ded447481 100644
--- a/main/work/add_document.php
+++ b/main/work/add_document.php
@@ -17,7 +17,8 @@ $current_course_tool  = TOOL_STUDENTPUBLICATION;
 $workId = isset($_GET['id']) ? intval($_GET['id']) : null;
 $docId = isset($_GET['document_id']) ? intval($_GET['document_id']) : null;
 $action = isset($_GET['action']) ? $_GET['action'] : null;
-$message = isset($_GET['message']) ? Security::remove_XSS($_GET['message']) : null;
+$message = Session::read('show_message');
+Session::erase('show_message');
 
 if (empty($workId)) {
     api_not_allowed(true);
@@ -69,7 +70,6 @@ if (empty($docId)) {
                 $link = Display::url(get_lang('Delete'), $url);
                 echo $docData['title'].' '.$link.'<br />';
             }
-
         }
         echo '</div>';
     }
@@ -110,7 +110,9 @@ if (empty($docId)) {
             $message = Display::return_message(get_lang('DocumentAlreadyAdded'), 'warning');
         }
 
-        $url = api_get_path(WEB_CODE_PATH).'work/add_document.php?id='.$workId.'&'.api_get_cidreq().'&message='.$message;
+        Session::write('show_message', $message);
+
+        $url = api_get_path(WEB_CODE_PATH).'work/add_document.php?id='.$workId.'&'.api_get_cidreq();
         header('Location: '.$url);
         exit;
     }