Remove questionable `@` in __singleMediaSelectionFormField.tpl

This looks like it is exploitable, because the value is not guaranteed to be an integer.

diff --git a/com.woltlab.wcf/templates/__singleMediaSelectionFormField.tpl b/com.woltlab.wcf/templates/__singleMediaSelectionFormField.tpl
index 80a54f9ef59405826a0aaca26e399cfe3aa159c3..aaec0dbd49edd5423412e67ab4fe18d79cc8d7c2 100644 (file)
--- a/com.woltlab.wcf/templates/__singleMediaSelectionFormField.tpl
+++ b/com.woltlab.wcf/templates/__singleMediaSelectionFormField.tpl
@@ -19,7 +19,7 @@
                </div>
        {/if}
        <p class="button jsMediaSelectButton jsMediaSelectButton_{@$field->getPrefixedId()}" data-store="{@$field->getPrefixedId()}"{if $field->isImageOnly()} data-display="{@$field->getPrefixedId()}_preview"{/if}>{lang}wcf.media.choose{if $field->isImageOnly()}Image{else}File{/if}{/lang}</p>
-       <input type="hidden" name="{@$field->getPrefixedId()}" id="{@$field->getPrefixedId()}"{if $field->getValue()} value="{@$field->getValue()}"{/if}>
+       <input type="hidden" name="{@$field->getPrefixedId()}" id="{@$field->getPrefixedId()}"{if $field->getValue()} value="{$field->getValue()}"{/if}>
        
        <script data-relocate="true">
                {include file='mediaJavaScript'}

diff --git a/wcfsetup/install/files/acp/templates/__singleMediaSelectionFormField.tpl b/wcfsetup/install/files/acp/templates/__singleMediaSelectionFormField.tpl
index 80a54f9ef59405826a0aaca26e399cfe3aa159c3..aaec0dbd49edd5423412e67ab4fe18d79cc8d7c2 100644 (file)
--- a/wcfsetup/install/files/acp/templates/__singleMediaSelectionFormField.tpl
+++ b/wcfsetup/install/files/acp/templates/__singleMediaSelectionFormField.tpl
@@ -19,7 +19,7 @@
                </div>
        {/if}
        <p class="button jsMediaSelectButton jsMediaSelectButton_{@$field->getPrefixedId()}" data-store="{@$field->getPrefixedId()}"{if $field->isImageOnly()} data-display="{@$field->getPrefixedId()}_preview"{/if}>{lang}wcf.media.choose{if $field->isImageOnly()}Image{else}File{/if}{/lang}</p>
-       <input type="hidden" name="{@$field->getPrefixedId()}" id="{@$field->getPrefixedId()}"{if $field->getValue()} value="{@$field->getValue()}"{/if}>
+       <input type="hidden" name="{@$field->getPrefixedId()}" id="{@$field->getPrefixedId()}"{if $field->getValue()} value="{$field->getValue()}"{/if}>
        
        <script data-relocate="true">
                {include file='mediaJavaScript'}