From cb0366b9f73b4421733bf0045654ed9d40eb578b Mon Sep 17 00:00:00 2001
From: johnnyq <johnny@pittpc.com>
Date: Tue, 9 May 2023 12:11:42 -0400
Subject: [PATCH] Fix XSS in expenses and trips export CSV modal Thanks
 @tdragon

---
 expense_export_modal.php | 4 ++--
 trip_export_modal.php    | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/expense_export_modal.php b/expense_export_modal.php
index 52a8d43a..09feab87 100644
--- a/expense_export_modal.php
+++ b/expense_export_modal.php
@@ -18,7 +18,7 @@
                             <div class="input-group-prepend">
                                 <span class="input-group-text"><i class="fa fa-fw fa-calendar"></i></span>
                             </div>
-                            <input type="date" class="form-control" name="date_from" max="2999-12-31" value="<?php echo $dtf; ?>">
+                            <input type="date" class="form-control" name="date_from" max="2999-12-31" value="<?php echo htmlentities($dtf); ?>">
                         </div>
                     </div>
 
@@ -28,7 +28,7 @@
                             <div class="input-group-prepend">
                                 <span class="input-group-text"><i class="fa fa-fw fa-calendar"></i></span>
                             </div>
-                            <input type="date" class="form-control" name="date_to" max="2999-12-31" value="<?php echo $dtt; ?>">
+                            <input type="date" class="form-control" name="date_to" max="2999-12-31" value="<?php echo htmlentities($dtt); ?>">
                         </div>
                     </div>
 
diff --git a/trip_export_modal.php b/trip_export_modal.php
index 5e94c3e8..0785dd93 100644
--- a/trip_export_modal.php
+++ b/trip_export_modal.php
@@ -18,7 +18,7 @@
                             <div class="input-group-prepend">
                                 <span class="input-group-text"><i class="fa fa-fw fa-calendar"></i></span>
                             </div>
-                            <input type="date" class="form-control" name="date_from" max="2999-12-31" value="<?php echo $dtf; ?>">
+                            <input type="date" class="form-control" name="date_from" max="2999-12-31" value="<?php echo htmlentities($dtf); ?>">
                         </div>
                     </div>
 
@@ -28,7 +28,7 @@
                             <div class="input-group-prepend">
                                 <span class="input-group-text"><i class="fa fa-fw fa-calendar"></i></span>
                             </div>
-                            <input type="date" class="form-control" name="date_to" max="2999-12-31" value="<?php echo $dtt; ?>">
+                            <input type="date" class="form-control" name="date_to" max="2999-12-31" value="<?php echo htmlentities($dtt); ?>">
                         </div>
                     </div>