Escape titles in Flex pages list (flex-objects#84)

getgrav · Nov 15, 2020 · 1396525 · 1396525
1 parent de46aff
commit 1396525
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 1 deletion.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -29,6 +29,7 @@
     * Fixed potential fatal error when creating flex index using cache [#3062](https://github.com/getgrav/grav/issues/3062)
     * Fixed fatal error in `CompiledFile` if the cached version is broken
     * Fixed updated media missing from media when editing Flex Object after page reload
+    * Escape titles in Flex pages list [flex-objects#84](https://github.com/trilbymedia/grav-plugin-flex-objects/issues/84)
 
 # v1.7.0-rc.17
 ## 10/07/2020

diff --git a/system/src/Grav/Common/Flex/Types/Pages/PageIndex.php b/system/src/Grav/Common/Flex/Types/Pages/PageIndex.php
@@ -489,7 +489,7 @@ protected function getLevelListingRecurse(array $options): array
                     $payload = [
                         'item-key' => basename($child->rawRoute() ?? $child->getKey()),
                         'icon' => $icon,
-                        'title' => $child->menu(),
+                        'title' => htmlspecialchars($child->menu()),
                         'route' => [
                             'display' => $child->getRoute()->toString(false) ?: '/',
                             'raw' => $child->rawRoute(),