Fixed: Ensure the story field in ordermgr's EditCustRequest form is html encoded
Fixes CVE-2019-10074
@@ -285,7 +285,7 @@ under the License.
<option key="9" description="${uiLabelMap.WorkEffortPriorityNine}"/>
</drop-down>
</field>
- <field name="story" use-when="custRequest==null" encode-output="false"><textarea cols="60" rows="12" default-value="${communicationEvent.content}"/></field>
+ <field name="story" use-when="custRequest==null"><textarea cols="60" rows="12" default-value="${communicationEvent.content}"/></field>
<field name="maximumAmountUomId">
<drop-down allow-empty="true" no-current-selected-key="${defaultOrganizationPartyCurrencyUomId}">
<entity-options key-field-name="uomId" description="${description} - ${abbreviation}" entity-name="Uom">
