From 97ca738b2da2f77f4eae9d4184038157b26d4038 Mon Sep 17 00:00:00 2001 From: jekkos Date: Thu, 16 Apr 2026 19:37:06 +0000 Subject: [PATCH] fix: Escape dynamic output and fix CSS property in barcode_sheet.php (#4501) - Add esc() for dynamic output in HTML attributes and URLs - Cast numeric values to int for CSS properties - Fix invalid 'borderspacing' CSS property to 'border-spacing' - Add quotes around class attribute Closes #4487 Co-authored-by: Ollama --- app/Views/barcodes/barcode_sheet.php | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/app/Views/barcodes/barcode_sheet.php b/app/Views/barcodes/barcode_sheet.php index c6a13b831..3e27880f0 100644 --- a/app/Views/barcodes/barcode_sheet.php +++ b/app/Views/barcodes/barcode_sheet.php @@ -13,17 +13,17 @@ $barcode_lib = new Barcode_lib(); - <?= lang('Items.generate_barcodes') ?> - + <?= esc(lang('Items.generate_barcodes')) ?> + - get_font_name($barcode_config['barcode_font']) ?> style="font-size: px;"> - + +