From 64d86d6869b29078ab649209d606b98e5190f913 Mon Sep 17 00:00:00 2001
From: M_Viper <admin@m-viper.de>
Date: Sun, 25 Oct 2026 17:57:42 +0000
Subject: [PATCH] Upload via GUI (333 Dateien)

---
 DeskHub-Webseite/staff/ticket_create.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/DeskHub-Webseite/staff/ticket_create.php b/DeskHub-Webseite/staff/ticket_create.php
index 48f53788..21236998 100644
--- a/DeskHub-Webseite/staff/ticket_create.php
+++ b/DeskHub-Webseite/staff/ticket_create.php
@@ -291,7 +291,7 @@ require __DIR__ . '/_header.php';
         <button type="button" onclick="document.execCommand('insertUnorderedList')">•</button>
         <button type="button" onclick="document.execCommand('insertOrderedList')">1.</button>
       </div>
-      <div class="richtext-editable" id="msg-editor" contenteditable="true"><?= $_POST['message'] ?? '' ?></div>
+      <div class="richtext-editable" id="msg-editor" contenteditable="true"><?= sanitize_staff_html((string) ($_POST['message'] ?? '')) ?></div>
     </div>
     <input type="hidden" name="message" id="msg-hidden">
   </div>
@@ -342,7 +342,7 @@ require __DIR__ . '/_header.php';
         <button type="button" onclick="document.execCommand('underline')"><u>U</u></button>
         <button type="button" onclick="document.execCommand('insertUnorderedList')">•</button>
       </div>
-      <div class="richtext-editable" id="note-editor" contenteditable="true" style="min-height:80px; border-color:var(--accent)"><?= $_POST['internal_note'] ?? '' ?></div>
+      <div class="richtext-editable" id="note-editor" contenteditable="true" style="min-height:80px; border-color:var(--accent)"><?= sanitize_staff_html((string) ($_POST['internal_note'] ?? '')) ?></div>
     </div>
     <input type="hidden" name="internal_note" id="note-hidden">
   </div>