diff --git a/application/dashboard.class.inc.php b/application/dashboard.class.inc.php
index 462399943..61f3baeb4 100644
--- a/application/dashboard.class.inc.php
+++ b/application/dashboard.class.inc.php
@@ -842,7 +842,7 @@ class RuntimeDashboard extends Dashboard
if (!$bEditMode && !$oPage->IsPrintableVersion())
{
$sId = $this->GetId();
- $sDivId = preg_replace('/[^a-zA-Z0-9_]/', '', $sId);
+ $sDivId = utils::Sanitize($sId, '', 'element_identifier');
if ($this->GetAutoReload())
{
$sFile = addslashes($this->GetDefinitionFile());
@@ -905,7 +905,7 @@ EOF
protected function RenderSelector($oPage, $aAjaxParams = array())
{
$sId = $this->GetId();
- $sDivId = preg_replace('/[^a-zA-Z0-9_]/', '', $sId);
+ $sDivId = utils::Sanitize($sId, '', 'element_identifier');
$sExtraParams = json_encode($aAjaxParams);
$sSelectorHtml = '
';
diff --git a/application/menunode.class.inc.php b/application/menunode.class.inc.php
index 3babcf41f..ce0637635 100644
--- a/application/menunode.class.inc.php
+++ b/application/menunode.class.inc.php
@@ -1190,7 +1190,7 @@ class DashboardMenuNode extends MenuNode
$oDashboard = $this->GetDashboard();
if ($oDashboard != null)
{
- $sDivId = preg_replace('/[^a-zA-Z0-9_]/', '', $this->sMenuId);
+ $sDivId = utils::Sanitize($this->sMenuId, '', 'element_identifier');
$oPage->add('
');
$aExtraParams['dashboard_div_id'] = $sDivId;
$oDashboard->SetReloadURL($this->GetHyperlink($aExtraParams));
diff --git a/application/utils.inc.php b/application/utils.inc.php
index 23da0f53f..bcdb4483c 100644
--- a/application/utils.inc.php
+++ b/application/utils.inc.php
@@ -275,13 +275,14 @@ class utils
/**
* @param string|string[] $value
* @param string $sSanitizationFilter one of : integer, class, string, context_param, parameter, field_name,
- * transaction_id, parameter, raw_data
+ * element_identifier, transaction_id, parameter, raw_data
*
* @return string|string[]|bool boolean for :
* * the 'class' filter (true if valid, false otherwise)
* * if the filter fails (@see \filter_var())
*
* @since 2.5.2 2.6.0 new 'transaction_id' filter
+ * @since 2.7.0 new 'element_identifier' filter
*/
protected static function Sanitize_Internal($value, $sSanitizationFilter)
{
@@ -351,6 +352,11 @@ class utils
}
break;
+ // For XML / HTML node identifiers
+ case 'element_identifier':
+ $retValue = preg_replace('/[^a-zA-Z0-9_]/', '', $value);
+ break;
+
default:
case 'raw_data':
$retValue = $value;
diff --git a/pages/ajax.render.php b/pages/ajax.render.php
index 7d1424d72..403d9fb74 100644
--- a/pages/ajax.render.php
+++ b/pages/ajax.render.php
@@ -1139,7 +1139,7 @@ try
$oDashboard->FromParams($aParams);
$oDashboard->Save();
$sDashboardFile = addslashes(utils::ReadParam('file', '', false, 'raw_data'));
- $sDivId = preg_replace('/[^a-zA-Z0-9_]/', '', $sDashboardId);
+ $sDivId = utils::Sanitize($sDashboardId, '', 'element_identifier');
// trigger a reload of the current page since the dashboard just changed
$oPage->add_script(
<<Revert();
$sFile = addslashes($oDashboard->GetDefinitionFile());
- $sDivId = preg_replace('/[^a-zA-Z0-9_]/', '', $sDashboardId);
+ $sDivId = utils::Sanitize($sDashboardId, '', 'element_identifier');
// trigger a reload of the current page since the dashboard just changed
$oPage->add_script(
<<