Changeset 17984 for trunk/password.php

Timestamp:

Sep 18, 2012, 2:09:45 PM (12 years ago)

Author:

plg

Message:

merge r17983 from branch 2.4 to trunk

bug 2750 fixed: HTML-sanitize $_POSTusername_or_email before display (both
username and email don't allow HTML tags...)

Original report by Stefan Schurtz via Secunia SVCRP

File:

• trunk/password.php (modified) (1 diff)

trunk/password.php

@@ -325 +325 @@
   if (isset($_POST['username_or_email']))
   {
-    $template->assign('username_or_email', stripslashes($_POST['username_or_email']));
+    $template->assign('username_or_email', stripslashes(strip_tags($_POST['username_or_email'])));
   }
 }