From 6020de6321ff0e7d5a059818cc1d5aebdb107d85 Mon Sep 17 00:00:00 2001
From: Mathieu Kooiman <mathieuk@gmail.com>
Date: Sun, 13 Mar 2016 14:25:46 +0100
Subject: [PATCH] Fix hard to exploit stored XSS possibility: code wrongly
 expected people to only be able to submit entries from <select>

---
 app/controllers/admin/LocationsController.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/controllers/admin/LocationsController.php b/app/controllers/admin/LocationsController.php
index 47ad5aea71..193d162354 100755
--- a/app/controllers/admin/LocationsController.php
+++ b/app/controllers/admin/LocationsController.php
@@ -75,7 +75,7 @@ class LocationsController extends AdminController
             } else {
                 $location->parent_id		= e(Input::get('parent_id'));
             }
-            $location->currency			= Input::get('currency','$');
+            $location->currency			= e(Input::get('currency','$'));
             $location->address			= e(Input::get('address'));
             $location->address2			= e(Input::get('address2'));
             $location->city    			= e(Input::get('city'));
@@ -203,7 +203,7 @@ class LocationsController extends AdminController
             } else {
                 $location->parent_id		= e(Input::get('parent_id',''));
             }
-            $location->currency			= Input::get('currency','$');
+            $location->currency			= e(Input::get('currency','$'));
             $location->address			= e(Input::get('address'));
             $location->address2			= e(Input::get('address2'));
             $location->city    			= e(Input::get('city'));