diff --git a/system/pages/forum/new_post.php b/system/pages/forum/new_post.php index c47302b6..b0db84fd 100644 --- a/system/pages/forum/new_post.php +++ b/system/pages/forum/new_post.php @@ -40,7 +40,7 @@ if(Forum::canPost($account_logged)) { $thread = $db->query("SELECT `" . FORUM_TABLE_PREFIX . "forum`.`post_topic`, `" . FORUM_TABLE_PREFIX . "forum`.`id`, `" . FORUM_TABLE_PREFIX . "forum`.`section` FROM `" . FORUM_TABLE_PREFIX . "forum` WHERE `" . FORUM_TABLE_PREFIX . "forum`.`id` = ".(int) $thread_id." AND `" . FORUM_TABLE_PREFIX . "forum`.`first_post` = ".$thread_id." LIMIT 1")->fetch(); if(isset($thread['id']) && Forum::hasAccess($thread['section'])) { - echo 'Boards >> '.$sections[$thread['section']]['name'].' >> '.$thread['post_topic'].' >> Post new reply

'.$thread['post_topic'].'

'; + echo 'Boards >> '.$sections[$thread['section']]['name'].' >> '.htmlspecialchars($thread['post_topic']).' >> Post new reply

'.htmlspecialchars($thread['post_topic']).'

'; $quote = isset($_REQUEST['quote']) ? (int) $_REQUEST['quote'] : NULL; $text = isset($_REQUEST['text']) ? stripslashes(trim($_REQUEST['text'])) : NULL; diff --git a/system/templates/forum.new_post.html.twig b/system/templates/forum.new_post.html.twig index ac07c311..d267b7db 100644 --- a/system/templates/forum.new_post.html.twig +++ b/system/templates/forum.new_post.html.twig @@ -50,7 +50,7 @@ {% set i = 0 %}
- Last 5 posts from thread: {{ topic|raw }} + Last 5 posts from thread: {{ topic }}