Sanitize in- and output.

1 files changed, 5 insertions, 1 deletions

diff --git a/apps/contacts/ajax/setproperty.php b/apps/contacts/ajax/setproperty.php
index cf3fe582247..f9e2a8e8647 100644
--- a/apps/contacts/ajax/setproperty.php
+++ b/apps/contacts/ajax/setproperty.php
@@ -37,9 +37,13 @@ $line = OC_Contacts_App::getPropertyLineByChecksum($vcard, $checksum);
 $value = $_POST['value'];
 if(is_array($value)){
 	ksort($value);  // NOTE: Important, otherwise the compound value will be set in the order the fields appear in the form!
+	foreach(array_keys($value) as $key) {
+		OC_Log::write('contacts','ajax/setproperty.php: setting: '.$key.': '.$value[$key], OC_Log::DEBUG);
+	}
+	$value = OC_VObject::escapeSemicolons($value);
 }
 OC_Log::write('contacts','ajax/setproperty.php: setting: '.$vcard->children[$line]->name.': '.$value, OC_Log::DEBUG);
-$vcard->children[$line]->setValue($value);
+$vcard->children[$line]->setValue(strip_tags($value));
 
 // Add parameters
 $postparameters = isset($_POST['parameters'])?$_POST['parameters']:array();