Remove possible XSS attack vector.

jakobo · Sep 2, 2013 · e546f3c · e546f3c
1 parent 8e8e50c
commit e546f3c
Show file tree

Hide file tree

Showing 2 changed files with 1 addition and 1 deletion.
diff --git a/src/easyxdm.swf b/src/easyxdm.swf
diff --git a/src/flash/net.easyxdm.flash/Main.as b/src/flash/net.easyxdm.flash/Main.as
@@ -95,7 +95,7 @@ class Main
 
 		// add the createChannel method
 		ExternalInterface.addCallback("createChannel", { }, function(channel:String, secret:String, remoteOrigin:String, isHost:Boolean) {
-			if (!Main.Validate(channel)) return;
+			if (!Main.Validate(channel) || !Main.Validate(secret)) return;
 			log("creating channel " + channel);
 
 			// get the remote domain