Digitalstack/myaac
2
0
Fork 0
mirror of https://github.com/slawkens/myaac.git synced 2025-04-26 17:29:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix XSS vulnerability

Browse Source
This commit is contained in:
slawkens 2023-09-16 10:31:33 +02:00
parent 50983a2b85
commit 5c3b01aca4
3 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
admin/pages/accounts.php
View File

@ -426,7 +426,7 @@ else if ($id > 0 && isset($account) && $account->isLoaded()) {
<div class="box-body">
<form action="<?php echo $base; ?>" method="post">
<div class="input-group input-group-sm">
<input type="text" class="form-control" name="search_name" value="<?php echo $search_account; ?>"
<input type="text" class="form-control" name="search_name" value="<?php echo escapeHtml($search_account); ?>"
maxlength="32" size="32">
<span class="input-group-btn">
<button type="submit" type="button" class="btn btn-info btn-flat">Search</button>

2
admin/pages/players.php
View File

@ -784,7 +784,7 @@ else if ($id > 0 && isset($player) && $player->isLoaded())
<div class="box-body">
<form action="<?php echo $base; ?>" method="post">
<div class="input-group input-group-sm">
<input type="text" class="form-control" name="search_name" value="<?php echo $search_name; ?>"
<input type="text" class="form-control" name="search_name" value="<?php echo escapeHtml($search_name); ?>"
maxlength="32" size="32">
<span class="input-group-btn">
<button type="submit" type="button" class="btn btn-info btn-flat">Search</button>

2
templates/tibiacom/index.php
View File

@ -21,7 +21,7 @@ if(isset($config['boxes']))
<?php
if(PAGE !== 'news') {
if(strpos(URI, 'subtopic=') !== false) {
$tmp = $_REQUEST['subtopic'];
$tmp = escapeHtml($_REQUEST['subtopic']);
if($tmp === 'accountmanagement') {
$tmp = 'accountmanage';
}