fix(sec): remove xss injection of service output in host form (#7865)

centreon · Sep 28, 2019 · 500bd68 · 500bd68
1 parent f3a29e0
commit 500bd68
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/www/include/monitoring/objectDetails/hostDetails.php b/www/include/monitoring/objectDetails/hostDetails.php
@@ -211,7 +211,10 @@
             $row['line_class'] = $class;
 
             /* Split the plugin_output */
-            $outputLines = explode("\n", $row['plugin_output']);
+            $outputLines = explode(
+                "\n",
+                htmlentities($row['plugin_output'], ENT_QUOTES, 'UTF-8')
+            );
             $row['short_output'] = $outputLines[0];
             $row["hnl"] = CentreonUtils::escapeSecure(urlencode($row["host_name"]));
             $row["sdl"] = CentreonUtils::escapeSecure(urlencode($row["service_description"]));