Skip to content

Y
yii2
Commit 8e4067ec by Carsten Brandt
Options

no xss for attribute error messages that contain {value}

parent 266f4f98
Showing with 1 addition and 1 deletion
framework/yii/assets/yii.activeForm.js
...@@ -345,7 +345,7 @@ ...@@ -345,7 +345,7 @@
var $container = $form.find(attribute.container); var $container = $form.find(attribute.container);
var $error = $container.find(attribute.error); var $error = $container.find(attribute.error);
if (hasError) { if (hasError) {
$error.html(messages[attribute.name][0]); $error.text(messages[attribute.name][0]);
$container.removeClass(data.settings.validatingCssClass + ' ' + data.settings.successCssClass) $container.removeClass(data.settings.validatingCssClass + ' ' + data.settings.successCssClass)
.addClass(data.settings.errorCssClass); .addClass(data.settings.errorCssClass);
} else { } else {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment