From ea85aeb3e5aa54e1bbec24e010846ad7e9e3b8bc Mon Sep 17 00:00:00 2001
From: bnu <bnufactory@gmail.com>
Date: Tue, 7 Jul 2015 17:59:44 +0900
Subject: [PATCH] =?UTF-8?q?SECISSUE=20fix=20#1583=20=EA=B2=80=EC=83=89=20?=
 =?UTF-8?q?=EB=8B=A8=EC=96=B4=EB=A5=BC=20=EB=8B=B4=EC=9D=80=20`is=5Fkeywor?=
 =?UTF-8?q?d`=EC=97=90=20=EB=8C=80=ED=95=9C=20escape?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 layouts/default/layout.html     | 2 +-
 layouts/user_layout/layout.html | 2 +-
 layouts/xedition/layout.html    | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/layouts/default/layout.html b/layouts/default/layout.html
index dfcc79ca4..ede4a99e2 100644
--- a/layouts/default/layout.html
+++ b/layouts/default/layout.html
@@ -22,7 +22,7 @@
 				<input type="hidden" name="vid" value="{$vid}" />
 				<input type="hidden" name="mid" value="{$mid}" />
 				<input type="hidden" name="act" value="IS" />
-				<input type="text" name="is_keyword" value="{$is_keyword}" required placeholder="{$lang->cmd_search}" title="{$lang->cmd_search}" />
+				<input type="text" name="is_keyword" value="{htmlspecialchars($is_keyword, ENT_COMPAT | ENT_HTML401, 'UTF-8', false)}" required placeholder="{$lang->cmd_search}" title="{$lang->cmd_search}" />
 				<input type="submit" value="{$lang->cmd_search}" />
 			</form>
 			<!-- /SEARCH -->
diff --git a/layouts/user_layout/layout.html b/layouts/user_layout/layout.html
index 0a2f46f6f..b677e01c0 100644
--- a/layouts/user_layout/layout.html
+++ b/layouts/user_layout/layout.html
@@ -6,7 +6,7 @@
 			<input type="hidden" name="vid" value="{$vid}" />
 			<input type="hidden" name="mid" value="{$mid}" />
 			<input type="hidden" name="act" value="IS" />
-			<input type="text" name="is_keyword" value="{$is_keyword}" title="{$lang->cmd_search}" />
+			<input type="text" name="is_keyword" value="{htmlspecialchars($is_keyword, ENT_COMPAT | ENT_HTML401, 'UTF-8', false)}" title="{$lang->cmd_search}" />
 			<input type="submit" value="{$lang->cmd_search}" />
 		</form>
 		<hr />
diff --git a/layouts/xedition/layout.html b/layouts/xedition/layout.html
index 61ecbed39..a8c994550 100644
--- a/layouts/xedition/layout.html
+++ b/layouts/xedition/layout.html
@@ -170,7 +170,7 @@
 					<input type="hidden" name="vid" value="{$vid}" />
 					<input type="hidden" name="mid" value="{$mid}" />
 					<input type="hidden" name="act" value="IS" />
-					<input type="text" name="is_keyword" value="{$is_keyword}" required="required" title="{$lang->cmd_search}" placeholder="Search" />
+					<input type="text" name="is_keyword" value="{htmlspecialchars($is_keyword, ENT_COMPAT | ENT_HTML401, 'UTF-8', false)}" required="required" title="{$lang->cmd_search}" placeholder="Search" />
 				</form>
 				<!-- /SEARCH -->
 				<a href="#" class="btn_close" title="{$lang->cmd_xedition_search_close}" onclick="return false"><i class="xi-close"></i><span class="blind">{$lang->cmd_xedition_search_close}</span></a>