TYPO3 Core

upps, here is no htmlspecialchars for the text ?

ok, again... there is a htmlspecialchars an the html tag in < e m >

in the function listOrderTitle() the line sould look like this

return isset($this->categories[$key])?$this->categories[$key]:' < e m > ['.$key.'] < / e m > ';

Hi!

thanks for the bug and digging up the code! want to have a look at my patch? i will bring it to core list in the evening

hi georg,
now there is now htmlspecialchars for the other cases on listOrderTitle()

case 'author_company':
                return $key;
                break;
            case 'state':
                return $this->states[$key];
                break;
            case 'type':
                return $this->typeDescr[$key];
                break;

this could be a possible XSS vulnerability,

I suggest simply removing the emphasis-tags in listOrderTitle() since we already have the brackets as indicator, would be sufficient.

Committed to trunk in revision 6573