From 55dbade8d5280c5baed45e5f7ebc3613b8e9b9e8 Mon Sep 17 00:00:00 2001 From: slawkens Date: Mon, 27 Nov 2023 22:58:24 +0100 Subject: [PATCH] Fix XSS in forum --- system/pages/forum/new_post.php | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/system/pages/forum/new_post.php b/system/pages/forum/new_post.php index 7437180b..32eb761b 100644 --- a/system/pages/forum/new_post.php +++ b/system/pages/forum/new_post.php @@ -33,6 +33,11 @@ if(Forum::canPost($account_logged)) $smile = (isset($_REQUEST['smile']) ? (int)$_REQUEST['smile'] : 0); $html = (isset($_REQUEST['html']) ? (int)$_REQUEST['html'] : 0); $saved = false; + + if (!superAdmin()) { + $html = 0; + } + if(isset($_REQUEST['quote'])) { $quoted_post = $db->query("SELECT `players`.`name`, `" . FORUM_TABLE_PREFIX . "forum`.`post_text`, `" . FORUM_TABLE_PREFIX . "forum`.`post_date` FROM `players`, `" . FORUM_TABLE_PREFIX . "forum` WHERE `players`.`id` = `" . FORUM_TABLE_PREFIX . "forum`.`author_guid` AND `" . FORUM_TABLE_PREFIX . "forum`.`id` = ".(int) $quote)->fetchAll();