// shipping block was missplaced on order-detail

2013-08-22 15:41:34 +02:00
parent b67827772b
commit a21d3fd22e
3 changed files with 18 additions and 19 deletions
@@ -387,7 +387,7 @@ class AdminControllerCore extends Controller
 			$filter = '';
 			foreach ($this->fields_list AS $field => $t)
 			{
-				if ($val = Tools::getValue($this->table.'Filter_'.$field))
+				if ($val = htmlspecialchars(Tools::getValue($this->table.'Filter_'.$field), ENT_QUOTES, 'UTF-8'))
 				{
 					if(!is_array($val) && !empty($val))
 						$filter .= ($filter ?  ', ' : $this->l(' filter by ')).$t['title'].' : ';