Fix stored and reflected XSS vulnerabilities

as described in VN: JVN#18387086 / TN: JPCERT#95011159 advisory.
sauruscms · Jan 27, 2015 · 1bc2728 · 1bc2728 · fgeek · Apr 8, 2015
1 parent 94d5526
commit 1bc2728
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/classes/adminpage.inc.php b/classes/adminpage.inc.php
@@ -302,6 +302,8 @@ function print_language_selectbox() {
     <table border="0" cellspacing="0" cellpadding="1">
 	<form name="languageform" method=get>
 	<? foreach($site->fdat as $fdat_field=>$fdat_value) {
+		$fdat_value = htmlspecialchars(xss_clean($fdat_value));
+		$fdat_field = htmlspecialchars(xss_clean($fdat_field)); 
 		if($fdat_field != 'flt_keel') {?>
 		<input type=hidden name="<?=$fdat_field?>" value="<?=$fdat_value?>">
 	<?	}