From 7a13338b4c9ee0f421a9e182e83cb2d8f458774e Mon Sep 17 00:00:00 2001
From: Andrew Dolgov <fox@bah.org.ru>
Date: Mon, 19 Oct 2009 23:29:45 +0400
Subject: fix proper escaping of label titles (closes #255)

---
 modules/backend-rpc.php | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

(limited to 'modules/backend-rpc.php')

diff --git a/modules/backend-rpc.php b/modules/backend-rpc.php
index 3e4a94340..1a65efc02 100644
--- a/modules/backend-rpc.php
+++ b/modules/backend-rpc.php
@@ -450,7 +450,8 @@
 			$ids = split(",", db_escape_string($_REQUEST["ids"]));
 			$label_id = db_escape_string($_REQUEST["lid"]);
 
-			$label = label_find_caption($link, $label_id, $_SESSION["uid"]);
+			$label = db_escape_string(label_find_caption($link, $label_id, 
+				$_SESSION["uid"]));
 
 			print "<rpc-reply>";
 			print "<info-for-headlines>";
@@ -485,7 +486,8 @@
 			$ids = split(",", db_escape_string($_REQUEST["ids"]));
 			$label_id = db_escape_string($_REQUEST["lid"]);
 
-			$label = label_find_caption($link, $label_id, $_SESSION["uid"]);
+			$label = db_escape_string(label_find_caption($link, $label_id, 
+				$_SESSION["uid"]));
 
 			print "<rpc-reply>";			
 
-- 
cgit v1.2.3