Using Json::htmlEncode() for safer JSON data encoding in HTML code …

…(samdark, Tomasz Tokarski)
razvanphp · May 10, 2015 · 2a23275 · 2a23275
1 parent 5130677
commit 2a23275
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 1 deletion.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -6,6 +6,7 @@ Yii Framework 2 gii extension Change Log
 
 - Bug #5098: Properly detect hasOne relations (nineinchnick)
 - Bug #6667: Gii form generator rendering mistake view (pana1990)
+- Bug (CVE-2015-3397): Using `Json::htmlEncode()` for safer JSON data encoding in HTML code (samdark, Tomasz Tokarski)
 - Enh #2109: Added ability to generate ActiveQuery class for model (klimov-paul)
 - Enh #7830: Added ability to detect relations between multiple schemas (nineinchnick)
 

diff --git a/components/ActiveField.php b/components/ActiveField.php
@@ -68,7 +68,7 @@ public function autoComplete($data)
         foreach ($data as &$item) {
             $item = ['word' => $item];
         }
-        $this->form->getView()->registerJs("yii.gii.autocomplete($counter, " . Json::encode($data) . ");");
+        $this->form->getView()->registerJs("yii.gii.autocomplete($counter, " . Json::htmlEncode($data) . ");");
 
         return $this;
     }