refPageParams: escaping opt output

dmstr · Nov 17, 2021 · 78f7939 · 78f7939
1 parent 8cf02e0
commit 78f7939
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/controllers/DefaultController.php b/controllers/DefaultController.php
@@ -21,6 +21,7 @@
 use Yii;
 use yii\base\Event;
 use yii\helpers\ArrayHelper;
+use yii\helpers\Html;
 use yii\helpers\Json;
 use yii\helpers\Url;
 use yii\web\Controller;
@@ -89,13 +90,13 @@ protected function refPageActionParamPageId()
                             continue;
                         }
                         // build human-readable label for each leave
-                        $pages[$leave->id] = implode(' :: ', ArrayHelper::merge(ArrayHelper::map($leave->parents()->all(), 'id', 'name'), [$leave->name . ' (' . $leave->id . ')']));
+                        $pages[$leave->id] = Html::encode(implode(' :: ', ArrayHelper::merge(ArrayHelper::map($leave->parents()->all(), 'id', 'name'), [$leave->name . ' (' . $leave->id . ')'])));
                     }
                 }
             }
         }
 
-        $params = ArrayHelper::merge(['' => Yii::t('pages', 'Select target page')], $pages);
+        $params = ArrayHelper::merge(['' => Html::encode(Yii::t('pages', 'Select target page'))], $pages);
         return $params;
 
     }