From 969a1eeab105acefb70ed0470523903f9cb5896e Mon Sep 17 00:00:00 2001
From: Luana <luana.latte.cat@gmail.com>
Date: Sun, 25 Jun 2023 20:48:03 -0300
Subject: [PATCH] html_escape on build_selector

---
 core/basethemelet.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/core/basethemelet.php b/core/basethemelet.php
index fc4d6caa..b1995660 100644
--- a/core/basethemelet.php
+++ b/core/basethemelet.php
@@ -201,7 +201,7 @@ class BaseThemelet
      * @param bool $empty_option Whether the first option should be an empty one.
      * @param array $selected_options The values of options that should be pre-selected.
      */
-    protected function build_selector(string $name, array $options, string $attributes, bool $empty_option=false, array $selected_options=[]): string
+    protected function build_selector(string $name, array $options, string $attributes="", bool $empty_option=false, array $selected_options=[]): string
     {
         $output = "<select name='" . $name . "' " . $attributes . ">";
 
@@ -211,9 +211,9 @@ class BaseThemelet
 
         foreach ($options as $value => $op) {
             if (in_array($value, $selected_options)) {
-                $output .= "<option value='" . $value . "' selected>" . $op . "</option>";
+                $output .= "<option value='" . $value . "' selected>" . html_escape($op) . "</option>";
             } else {
-                $output .= "<option value='" . $value . "' >" . $op . "</option>";
+                $output .= "<option value='" . $value . "' >" . html_escape($op) . "</option>";
             }
         }