diff options
| author | czaks <marcin@6irc.net> | 2014-03-27 13:10:53 +0100 |
|---|---|---|
| committer | czaks <marcin@6irc.net> | 2014-03-27 13:10:53 +0100 |
| commit | 56eaf863f2593920161d5588c9ca63fe8e9312ce (patch) | |
| tree | 4b7873b096b275ef4477ff042397db4e9b18fb09 /attentionbar.php | |
| parent | ba6744a1c6f5cf13f43b132509d4b55fdff30e99 (diff) | |
SECURITY: fix XSS vulnerability
Diffstat (limited to 'attentionbar.php')
| -rw-r--r-- | attentionbar.php | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/attentionbar.php b/attentionbar.php index 18a5d9ac..25f349cb 100644 --- a/attentionbar.php +++ b/attentionbar.php @@ -3,7 +3,7 @@ checkBan(); $text = isset($_POST['text']) ? $_POST['text'] : ''; if(strlen($text)>0 && !preg_match('/a href/', $text)) { - file_put_contents("attentionbar.txt",$text); + file_put_contents("attentionbar.txt",htmlspecialchars($text)); if(strlen($_SERVER['HTTP_REFERER'])>0) { header('Location: ' . $_SERVER['HTTP_REFERER']); } else { header('Location: /'); } } else print(file_get_contents("attentionbar.txt")); |