From 13965252518bb8a23328a10f47b9b4e49b0d0f1f Mon Sep 17 00:00:00 2001
From: Djamil Legato <djamil@djamil.it>
Date: Sun, 15 Nov 2020 12:00:47 -0800
Subject: [PATCH] Escape titles in Flex pages list (flex-objects#84)

---
 CHANGELOG.md                                          | 1 +
 system/src/Grav/Common/Flex/Types/Pages/PageIndex.php | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e98dd1825..027574098 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -29,6 +29,7 @@
     * Fixed potential fatal error when creating flex index using cache [#3062](https://github.com/getgrav/grav/issues/3062)
     * Fixed fatal error in `CompiledFile` if the cached version is broken
     * Fixed updated media missing from media when editing Flex Object after page reload
+    * Escape titles in Flex pages list [flex-objects#84](https://github.com/trilbymedia/grav-plugin-flex-objects/issues/84)
 
 # v1.7.0-rc.17
 ## 10/07/2020
diff --git a/system/src/Grav/Common/Flex/Types/Pages/PageIndex.php b/system/src/Grav/Common/Flex/Types/Pages/PageIndex.php
index 0e7e961d1..d97234067 100644
--- a/system/src/Grav/Common/Flex/Types/Pages/PageIndex.php
+++ b/system/src/Grav/Common/Flex/Types/Pages/PageIndex.php
@@ -489,7 +489,7 @@ class PageIndex extends FlexPageIndex implements PageCollectionInterface
                     $payload = [
                         'item-key' => basename($child->rawRoute() ?? $child->getKey()),
                         'icon' => $icon,
-                        'title' => $child->menu(),
+                        'title' => htmlspecialchars($child->menu()),
                         'route' => [
                             'display' => $child->getRoute()->toString(false) ?: '/',
                             'raw' => $child->rawRoute(),