properly escape feed error message in headlines toolbar

11 years ago · 12d17734f6
parent 7a7a0dc2dd
commit 12d17734f6
1 changed files with 2 additions and 1 deletions
--- a/classes/feeds.php
+++ b/classes/feeds.php
@ -63,7 +63,8 @@ class Feeds extends Handler_Protected {
 				truncate_string($feed_title,30)."</a>";

 			if ($error) {
-				$reply .= "&nbsp;<img title='$error' src='images/error.png' alt='error' class=\"noborder\" style=\"vertical-align : middle\">";
+				$error = htmlspecialchars($error);
+				$reply .= "&nbsp;<img title=\"$error\" src='images/error.png' alt='error' class=\"noborder\" style=\"vertical-align : middle\">";
 			}

 		} else {