dualfroz bb891e182e fix(security): escape the project name in the analytic modal title ...

LayoutHelper::analytic() prefixes the title with the raw project name, and
the AJAX branch of analytic/layout.php printed that title as is, so a
project name containing markup was injected into the analytic modals.

Escape it with $this->text->e() like the other layouts do. It does not
double-encode, so the ">" separator still renders as ">".

2026-10-03 15:58:07 +02:00

..

Controller

fix(ical): only accept known columns as the calendar start date

2026-10-03 16:44:04 +02:00

Core/Session

fix(session): scope the session cookie to the directory without a trailing slash

2026-10-02 09:50:13 +08:00

Template/analytic

fix(security): escape the project name in the analytic modal title

2026-10-03 15:58:07 +02:00