fix customize CSS dialog disappearing newlines

diff --git a/classes/rpc.php b/classes/rpc.php
index ef89a2141db726e8737def686067d42fa84f42ea..7ecb1ae638daf4bae99cc28e9908697739f592e3 100644 (file)
--- a/classes/rpc.php
+++ b/classes/rpc.php
@@ -212,10 +212,9 @@ class RPC extends Protected_Handler {
        function setpref() {
                $value = str_replace("\n", "<br/>", $_REQUEST['value']);
 
-               $key = db_escape_string($_REQUEST["key"]);
-               $value = db_escape_string($value);
+               // set_pref escapes input, so no need to double escape it here
 
-               set_pref($this->link, $key, $value);
+               set_pref($this->link, $key, $value, $_SESSION['uid'], false);
 
                print json_encode(array("param" =>$key, "value" => $value));
        }

diff --git a/include/db-prefs.php b/include/db-prefs.php
index b62e01a7b4ecd7c777cc6deaefc706b9d4d923b5..696aae5d16d9689896477912fb54909cd46d0eb8 100644 (file)
--- a/include/db-prefs.php
+++ b/include/db-prefs.php
@@ -79,9 +79,9 @@
                }
        }
 
-       function set_pref($link, $pref_name, $value, $user_id = false) {
+       function set_pref($link, $pref_name, $value, $user_id = false, $strip_tags = true) {
                $pref_name = db_escape_string($pref_name);
-               $value = db_escape_string($value);
+               $value = db_escape_string($value, $strip_tags);
 
                if (!$user_id) {
                        $user_id = $_SESSION["uid"];