From 0e84799f59ebf8d14f6b165f48ea04500fab646b Mon Sep 17 00:00:00 2001
From: Robbie Averill <robbie@averill.co.nz>
Date: Wed, 6 Dec 2017 13:40:46 +1300
Subject: [PATCH] FIX Ensure actions panel keys and values have possible HTML
 escaped

---
 code/model/DMSDocument.php | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/code/model/DMSDocument.php b/code/model/DMSDocument.php
index a4ba0ca..8cd4bb5 100644
--- a/code/model/DMSDocument.php
+++ b/code/model/DMSDocument.php
@@ -1320,6 +1320,9 @@ class DMSDocument extends DataObject implements DMSDocumentInterface
             . '<ul>';
 
         foreach ($this->actionTasks as $panelKey => $title) {
+            $panelKey = Convert::raw2xml($panelKey);
+            $title = Convert::raw2xml($title);
+
             $html .= '<li class="ss-ui-button dmsdocument-action" data-panel="' . $panelKey . '">'
                 . _t('DMSDocument.ACTION_' . strtoupper($panelKey), $title)
                 . '</li>';