From ae841da1f1b7121bd81ff5727f326d8573b22006 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tomasz=20Chili=C5=84ski?= <tomasz.chilinski@chilan.com>
Date: Sun, 17 Jan 2021 19:40:00 +0100
Subject: [PATCH] bugfix: avoid XSS in nodeadd (LMS #1910)

---
 templates/default/node/nodeaddbox.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/default/node/nodeaddbox.html b/templates/default/node/nodeaddbox.html
index 740dd60410..f2d8d438aa 100644
--- a/templates/default/node/nodeaddbox.html
+++ b/templates/default/node/nodeaddbox.html
@@ -217,7 +217,7 @@
 												>{$project.name|escape}</OPTION>
 										{/foreach}
 									</SELECT>
-									<INPUT TYPE="TEXT" NAME="nodedata[projectname]" VALUE="{$nodedata.projectname}"
+									<INPUT TYPE="TEXT" NAME="nodedata[projectname]" VALUE="{$nodedata.projectname|escape}"
 										{tip text="Enter new project name" trigger="projectname" } id="projectname"
 										{if !isset($nodedata.invprojectid) || empty($nodedata.invprojectid)} style="display: none;"{/if}>