Changeset 851 for trunk/Modules/User/UserList.php

Timestamp:

Jan 17, 2016, 10:07:13 PM (8 years ago)

Author:

chronos

Message:

• Fixed: Use htmlspecialchars function for user inserted content to avoid breaking page HTML structure. Added for forum, teams, dictionary and profile text.

File:

• trunk/Modules/User/UserList.php (modified) (1 diff)

trunk/Modules/User/UserList.php

@@ -20 +20 @@
     {
       $TeamId = $_GET['team'] * 1;
-      $DbResult = $this->Database->select('Team', 'Name', 'Id='.$TeamId);
+      $DbResult = $this->Database->select('Team', 'Name', '`Id`='.$TeamId);
       if($DbResult->num_rows > 0)
       {
         $Team = $DbResult->fetch_assoc();
-        $Output .= '<h3>'.sprintf(T('Users in team %s'), $Team['Name']).'</h3>';
+        $Output .= '<h3>'.sprintf(T('Users in team %s'), htmlspecialchars($Team['Name'])).'</h3>';
         $TeamFilter = ' AND (`Team`='.$_GET['team'].')';
       } else {