- bugfix escape Smarty exception messages to avoid possible script execution

change_log.txt

@@ -1,4 +1,7 @@
 ===== trunk  =====
+11.09.2012
+- bugfix escape Smarty exception messages to avoid possible script execution
+
 10.09.2012
 - bugfix tag option flags and shorttag attributes did not work when rdel started with '=' (Forum Topic 22979)
 

libs/Smarty.class.php

@@ -1481,6 +1481,9 @@ if (Smarty::$_CHARSET !== 'UTF-8') {
  * @package Smarty
  */
 class SmartyException extends Exception {
+    public function __construct($message) {
+        $this->message = htmlentities($message);
+    }
 }
 
 /**