Always add slash

system/admin/views/menu.html.php

@@ -19,7 +19,7 @@ function parseMenus($menus) {
 }
 
 function parseMenu($menu) {
-	$li = '<li class="dd-item" data-class="'. $menu->class .'" data-id="'. $menu->id .'" data-name="'.$menu->name.'" data-slug="'.$menu->slug.'">';
+	$li = '<li class="dd-item" data-class="'. $menu->class .'" data-id="'. $menu->id .'" data-name="'.$menu->name.'" data-slug="'.htmlspecialchars($menu->slug, FILTER_SANITIZE_URL).'">';
 	$li .= '<div class="dd-handle">'.$menu->name.'</div>';
 	$li .= '<span class="button-delete btn btn-danger btn-xs" data-owner-id="'.$menu->id.'">Delete</span>';
 	$li .= '<span class="button-edit btn btn-primary btn-xs" data-owner-id="'.$menu->id.'">Edit</span>';

system/includes/functions.php

@@ -2021,7 +2021,7 @@ function parseNode($node, $child = null) {
 			}
 		}
 		
-		$li .= '<a href="'.$node->slug.'">'.$node->name.'</a>';
+		$li .= '<a href="'.htmlspecialchars(rtrim($node->slug, '/') . '/', FILTER_SANITIZE_URL).'">'.$node->name.'</a>';
 		if (isset($node->children)) { 
 			$li .= parseNodes($node->children, true, null);
 		}
@@ -2047,7 +2047,7 @@ function parseNode($node, $child = null) {
 			}
 		}
 		
-		$li .= '<a class="dropdown-toggle" data-toggle="dropdown" href="'.$node->slug.'">'.$node->name.'<b class="caret"></b></a>';
+		$li .= '<a class="dropdown-toggle" data-toggle="dropdown" href="'.htmlspecialchars(rtrim($node->slug, '/') . '/', FILTER_SANITIZE_URL).'">'.$node->name.'<b class="caret"></b></a>';
 		if (isset($node->children)) { 
 			$li .= parseNodes($node->children, true, null);
 		}