ojsde/ojs — comment on commit bed9fac3d48dacdf75c706c2daf86ed80afd4cfe
File: plugins/importexport/medra/classes/MedraWebservice.inc.php line 78
By jerico-dev:

All arguments are under direct programmatic control inside this class except for $attachments which contains XML code generated from the DOM which should therefore already be correctly escaped.