From 169fb9cf51dbc25ef44a27a2966735bd55eca152 Mon Sep 17 00:00:00 2001
From: Dany De Bontridder <danydb@noalyss.eu>
Date: Sat, 2 Jun 2018 08:33:03 +0200
Subject: [PATCH] Security fix : f_id is a number

---
 include/lib/html_input.class.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/lib/html_input.class.php b/include/lib/html_input.class.php
index 08929669c..d1f88f997 100755
--- a/include/lib/html_input.class.php
+++ b/include/lib/html_input.class.php
@@ -827,6 +827,7 @@ class HtmlInput
     static function title_box($p_name, $p_div, $p_mod="close", $p_js="",
             $p_draggable="n")
     {
+        $p_div=strip_tags($p_div);
         $r='<div class="bxbutton">';
 
         // If draggable : display a icon to unpin and move the dialog box