Merge pull request #5 from a91082900/master

Admin Panel XSS vulnerability fixed
2019-10-04 12:36:53 +08:00
parent 34cf2afa09 be5a48143b
commit 683bdc9ee6
1 changed files with 1 additions and 1 deletions
--- a/admin/ajax/config.php
+++ b/admin/ajax/config.php
@@ -30,7 +30,7 @@ if ($_SERVER["REQUEST_METHOD"] == "POST") {
        $limit = abs(intval(@$_POST["limit"]));
        $content = file_get_contents($template_filename);
        $new_content = strtr($content, array(
-            "{blog_name}" => addslashes(@$_POST["name"]),
+            "{blog_name}" => addslashes(@htmlspecialchars($_POST["name"])),
            "{limit}" => ($limit != 0 ? $limit : 10),
            "{register}" => (@$_POST["register"] === "true" ? "true" : "false")
        ));