Merge pull request #16 from paintballrefjosh/bug-fixes

Fixed XSS exploit in install script
paintballrefjosh · Mar 4, 2017 · 4056a68 · 4056a68
2 parents 6be7801 + 4509beb
commit 4056a68
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/install/index.php b/install/index.php
@@ -30,9 +30,10 @@ function output_message($type, $text)
 		<div class="content">				
 			<div class="content-header">
 			<?php
+
 				if(isset($_GET['step']))
 				{
-					$step = $_GET['step'];
+					$step = htmlspecialchars($_GET['step']);
 				}
 				else
 				{