From 65a993fe06abaadcbcb23f6c239db36eb6471954 Mon Sep 17 00:00:00 2001
From: fishystock <215427190+fishystock@users.noreply.github.com>
Date: Fri, 7 Aug 2026 18:58:17 -0400
Subject: security: fix stored xss on calendar api

---
 templates/themes/calendar/calendarpost.php | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

(limited to 'templates/themes/calendar/calendarpost.php')

diff --git a/templates/themes/calendar/calendarpost.php b/templates/themes/calendar/calendarpost.php
index ac2c1a72..7ad9377a 100644
--- a/templates/themes/calendar/calendarpost.php
+++ b/templates/themes/calendar/calendarpost.php
@@ -51,7 +51,11 @@ $method = $_SERVER['REQUEST_METHOD'];
 	} elseif ($method == 'GET') {
 		// Method is GET
 		$query = query("SELECT * FROM calendar_events ORDER BY id") or error(db_error());
-		 echo json_encode($query->fetchAll(PDO::FETCH_ASSOC), JSON_THROW_ON_ERROR);
+
+		header('Content-Type: application/json; charset=utf-8');
+		header('X-Content-Type-Options: nosniff');
+
+		echo json_encode($query->fetchAll(PDO::FETCH_ASSOC), JSON_THROW_ON_ERROR);
 	}
 
 ?>
-- 
cgit v1.3