From cc7d01daa7fe3c525718c7ef19f82d13e51cc080 Mon Sep 17 00:00:00 2001
From: Madhura Jayaratne <madhura.cj@gmail.com>
Date: Tue, 12 Jul 2016 11:27:36 +1000
Subject: [PATCH] Fix XSS in tbl_gis_visualization.php

Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
---
 templates/table/gis_visualization/gis_visualization.phtml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/templates/table/gis_visualization/gis_visualization.phtml b/templates/table/gis_visualization/gis_visualization.phtml
index d62c46b00c..b6b956be85 100644
--- a/templates/table/gis_visualization/gis_visualization.phtml
+++ b/templates/table/gis_visualization/gis_visualization.phtml
@@ -10,8 +10,8 @@
                 <select name="visualizationSettings[labelColumn]" id="labelColumn" class="autosubmit">
                     <option value=""><?= __("-- None --"); ?></option>
                     <?php foreach ($labelCandidates as $value): ?>
-                        <option value="<?= $value; ?>" <?= ($value == $visualizationSettings['labelColumn'] ? 'selected="selected"' : ''); ?>>
-                            <?= $value; ?>
+                        <option value="<?= htmlspecialchars($value); ?>" <?= ($value == $visualizationSettings['labelColumn'] ? 'selected="selected"' : ''); ?>>
+                            <?= htmlspecialchars($value); ?>
                         </option>
                     <?php endforeach; ?>
                 </select>
@@ -20,8 +20,8 @@
                 </label>
                 <select name="visualizationSettings[spatialColumn]" id="spatialColumn" class="autosubmit">
                     <?php foreach ($spatialCandidates as $value): ?>
-                        <option value="<?= $value; ?>" <?= ($value == $visualizationSettings['spatialColumn'] ? 'selected="selected"' : ''); ?>>
-                            <?= $value; ?>
+                        <option value="<?= htmlspecialchars($value); ?>" <?= ($value == $visualizationSettings['spatialColumn'] ? 'selected="selected"' : ''); ?>>
+                            <?= htmlspecialchars($value); ?>
                         </option>
                     <?php endforeach; ?>
                 </select>