danwin1210/le-chat-php
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Minor security fix for XSS vulnerability - previously mitigated by CSP

Browse Source
This commit is contained in:
Daniel Winzen
2025-12-25 20:33:23 +01:00
parent a6bd50a7be
commit e017b5c883
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
chat.php
View File

@@ -2228,14 +2228,14 @@ function send_del_confirm(): void
echo hidden('multi', 'on');
}
if(isset($_POST['sendto'])){
echo hidden('sendto', $_POST['sendto']);
echo hidden('sendto', htmlspecialchars($_POST['sendto']));
}
echo hidden('confirm', 'yes').hidden('what', $_POST['what']).submit(_('Yes'), 'class="delbutton"').'</form></td><td>'.form('post');
echo hidden('confirm', 'yes').hidden('what', htmlspecialchars($_POST['what'])).submit(_('Yes'), 'class="delbutton"').'</form></td><td>'.form('post');
if(isset($_POST['multi'])){
echo hidden('multi', 'on');
}
if(isset($_POST['sendto'])){
echo hidden('sendto', $_POST['sendto']);
echo hidden('sendto', htmlspecialchars($_POST['sendto']));
}
echo submit(_('No'), 'class="backbutton"').'</form></td><tr></table>';
print_end();