Skip to content

Commit 140f587

Browse files
committed
Forum: add remove_xss
1 parent 122f7bc commit 140f587

File tree

2 files changed

+5
-4
lines changed

2 files changed

+5
-4
lines changed

main/forum/forumfunction.inc.php

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4690,12 +4690,13 @@ function move_thread_form()
46904690
</div>
46914691
<div class="formw">';
46924692
$htmlcontent .= '<select name="forum">';
4693-
foreach ($forum_categories as $key => $category) {
4693+
foreach ($forum_categories as $category) {
46944694
$htmlcontent .= '<optgroup label="'.$category['cat_title'].'">';
46954695
foreach ($forums as $key => $forum) {
46964696
if (isset($forum['forum_category'])) {
46974697
if ($forum['forum_category'] == $category['cat_id']) {
4698-
$htmlcontent .= '<option value="'.$forum['forum_id'].'">'.$forum['forum_title'].'</option>';
4698+
$htmlcontent .= '<option value="'.$forum['forum_id'].'">'.
4699+
Security::remove_XSS($forum['forum_title']).'</option>';
46994700
}
47004701
}
47014702
}

main/forum/index.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -270,13 +270,13 @@ function hidecontent(content){
270270
if (empty($forumCategory['cat_title'])) {
271271
$forumCategoryInfo['title'] = get_lang('WithoutCategory');
272272
} else {
273-
$forumCategoryInfo['title'] = $forumCategory['cat_title'];
273+
$forumCategoryInfo['title'] = Security::remove_XSS($forumCategory['cat_title']);
274274
}
275275
$forumCategoryInfo['extra_fields'] = isset($forumCategory['extra_fields']) ? $forumCategory['extra_fields'] : [];
276276
$forumCategoryInfo['icon_session'] = api_get_session_image($forumCategory['session_id'], $_user['status']);
277277

278278
// Validation when belongs to a session
279-
$forumCategoryInfo['description'] = $forumCategory['cat_comment'];
279+
$forumCategoryInfo['description'] = Security::remove_XSS($forumCategory['cat_comment']);
280280
$forumCategory['session_display'] = null;
281281
if (empty($sessionId) && !empty($forumCategory['session_name'])) {
282282
$forumCategory['session_display'] = ' ('.Security::remove_XSS($forumCategory['session_name']).')';

0 commit comments

Comments
 (0)