Fixed Unescaped phrase toggle_expanded in Template PAGE_CONTAINER

[Kirby]

Affected version

2.x

This should be fixed according to https://xenforo.com/community/threads/attributes-are-not-always-filtered.153086/ but I can still break the page by changing phrase toggle_expanded to <p>Does this break?</p>Toggle expanded

 

[Chris D]

It looks like it was missed from the public version of the template, but we did amend it on the admin version.

 

[XF Bug Bot]

Thank you for reporting this issue. The issue is now resolved and we are aiming to include that in a future XF release (2.0.12).

Change log:

Ensure phrase is escaped in HTML attribute.

Any changes made as a result of this issue being resolved may not be rolled out here until later.