Changeset 851 for trunk/Modules/User/Options.php

Timestamp:

Jan 17, 2016, 10:07:13 PM (9 years ago)

Author:

chronos

Message:

• Fixed: Use htmlspecialchars function for user inserted content to avoid breaking page HTML structure. Added for forum, teams, dictionary and profile text.

File:

• trunk/Modules/User/Options.php (modified) (2 diffs)

trunk/Modules/User/Options.php

@@ -30 +30 @@
       '<tr><td>'.T('Preferred client version').': </td><td>'.ClientVersionSelection($this->System->User->PreferredVersion).'</td></tr>'.
       '<tr><td>'.T('Public profile text').':</td><td>'.
-      '<textarea name="info" cols="60" rows="10">'.$this->System->User->Info.'</textarea></td></tr>';
+      '<textarea name="info" cols="60" rows="10">'.htmlspecialchars($this->System->User->Info).'</textarea></td></tr>';
 
     $Output .= '<tr><td>';
@@ -64 +64 @@
       $Output .= '<option value="'.$LineTeam['Id'].'"';
       if ($LineTeam['Id'] == $this->System->User->Team) $Output .= ' selected="selected"';
-      $Output .= '>'.$LineTeam['Name'].'</option>';
+      $Output .= '>'.htmlspecialchars($LineTeam['Name']).'</option>';
     }
     $Output .= '</select> <input type="submit" value="'.T('Enter').'" />