From 57acb83546e0bc411800092f9744d2849e756538 Mon Sep 17 00:00:00 2001
From: Damian Mooyman <damian@silverstripe.com>
Date: Thu, 6 Jul 2017 17:27:07 +1200
Subject: [PATCH] Sanitise GridFieldAddNewMultiClassHandler::Link()

---
 src/GridFieldAddNewMultiClass.php        |  6 ++++--
 src/GridFieldAddNewMultiClassHandler.php | 12 +++++++++++-
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/src/GridFieldAddNewMultiClass.php b/src/GridFieldAddNewMultiClass.php
index 7aa7f2a..38ce6c9 100755
--- a/src/GridFieldAddNewMultiClass.php
+++ b/src/GridFieldAddNewMultiClass.php
@@ -265,7 +265,8 @@ class GridFieldAddNewMultiClass implements GridField_HTMLProvider, GridField_URL
      * Sanitise a model class' name for inclusion in a link
      * @return string
      */
-    protected function sanitiseClassName($class) {
+    protected function sanitiseClassName($class)
+    {
         return str_replace('\\', '-', $class);
     }
 
@@ -273,7 +274,8 @@ class GridFieldAddNewMultiClass implements GridField_HTMLProvider, GridField_URL
      * Unsanitise a model class' name from a URL param
      * @return string
      */
-    protected function unsanitiseClassName($class) {
+    protected function unsanitiseClassName($class)
+    {
         return str_replace('-', '\\', $class);
     }
 }
diff --git a/src/GridFieldAddNewMultiClassHandler.php b/src/GridFieldAddNewMultiClassHandler.php
index 4d4f3b3..f97bfdf 100644
--- a/src/GridFieldAddNewMultiClassHandler.php
+++ b/src/GridFieldAddNewMultiClassHandler.php
@@ -19,8 +19,18 @@ class GridFieldAddNewMultiClassHandler extends GridFieldDetailForm_ItemRequest
             return Controller::join_links(
                 $this->gridField->Link(),
                 'add-multi-class',
-                get_class($this->record)
+                $this->sanitiseClassName(get_class($this->record))
             );
         }
     }
+
+
+    /**
+     * Sanitise a model class' name for inclusion in a link
+     * @return string
+     */
+    protected function sanitiseClassName($class)
+    {
+        return str_replace('\\', '-', $class);
+    }
 }