From 56eaf863f2593920161d5588c9ca63fe8e9312ce Mon Sep 17 00:00:00 2001
From: czaks <marcin@6irc.net>
Date: Thu, 27 Mar 2014 13:10:53 +0100
Subject: SECURITY: fix XSS vulnerability

---
 attentionbar.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'attentionbar.php')

diff --git a/attentionbar.php b/attentionbar.php
index 18a5d9ac..25f349cb 100644
--- a/attentionbar.php
+++ b/attentionbar.php
@@ -3,7 +3,7 @@
  checkBan();
  $text = isset($_POST['text']) ? $_POST['text'] : '';
  if(strlen($text)>0 && !preg_match('/a href/', $text)) {
-	file_put_contents("attentionbar.txt",$text);
+	file_put_contents("attentionbar.txt",htmlspecialchars($text));
 	 if(strlen($_SERVER['HTTP_REFERER'])>0) { header('Location: ' . $_SERVER['HTTP_REFERER']); }
  	else { header('Location: /'); }
  } else print(file_get_contents("attentionbar.txt"));
-- 
cgit v1.3