From 65be169d34b787d26db7955b860ffc2370d53dae Mon Sep 17 00:00:00 2001
From: Dany De Bontridder <danydb@noalyss.eu>
Date: Sat, 2 Jun 2018 08:33:03 +0200
Subject: [PATCH] Security fix : f_id is a number

---
 include/lib/html_input.class.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/lib/html_input.class.php b/include/lib/html_input.class.php
index a69eaaf53..3fffb05af 100755
--- a/include/lib/html_input.class.php
+++ b/include/lib/html_input.class.php
@@ -826,6 +826,7 @@ class HtmlInput
     static function title_box($p_name, $p_div, $p_mod="close", $p_js="",
             $p_draggable="n")
     {
+        $p_div=strip_tags($p_div);
         $r='<div class="bxbutton">';
 
         // If draggable : display a icon to unpin and move the dialog box