cleaning REQUEST_URI for good measure

PrivateBin · Jul 18, 2016 · e7dde4d · e7dde4d · rugk · Jul 18, 2016
1 parent e1d6db8
commit e7dde4d
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/lib/privatebin.php b/lib/privatebin.php
@@ -176,7 +176,8 @@ private function _init()
         $this->_conf = new configuration;
         $this->_model = new model($this->_conf);
         $this->_request = new request;
-        $this->_urlbase = array_key_exists('REQUEST_URI', $_SERVER) ? $_SERVER['REQUEST_URI'] : '/';
+        $this->_urlbase = array_key_exists('REQUEST_URI', $_SERVER) ?
+            htmlspecialchars($_SERVER['REQUEST_URI']) : '/';
 
         // set default language
         $lang = $this->_conf->getKey('languagedefault');