From 8f6ddadffcd683c16fbbe622acf374eea1e39c74 Mon Sep 17 00:00:00 2001
From: Remigijus Kiminas <remdex@gmail.com>
Date: Sat, 25 Dec 2021 14:54:15 -0500
Subject: [PATCH] Proper escape

---
 lhc_web/design/defaulttheme/tpl/lhchat/avatarbuilder.tpl.php | 2 +-
 lhc_web/modules/lhuser/avatarbuilder.php                     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lhc_web/design/defaulttheme/tpl/lhchat/avatarbuilder.tpl.php b/lhc_web/design/defaulttheme/tpl/lhchat/avatarbuilder.tpl.php
index b7081fe946..513fcc52f7 100644
--- a/lhc_web/design/defaulttheme/tpl/lhchat/avatarbuilder.tpl.php
+++ b/lhc_web/design/defaulttheme/tpl/lhchat/avatarbuilder.tpl.php
@@ -63,7 +63,7 @@
                     <?php endforeach; ?>
                 </div>
                 <div class="col-6">
-                    <img width="w-100" id="id_avatar_img" src='<?php echo erLhcoreClassDesign::baseurl('widgetrestapi/avatar')?>/<?php echo htmlspecialchars($id)?>' alt="" title="" />
+                    <img width="w-100" id="id_avatar_img" src='<?php echo erLhcoreClassDesign::baseurl('widgetrestapi/avatar')?>/<?php echo urlencode(htmlspecialchars($id))?>' alt="" title="" />
                 </div>
             </div>
 
diff --git a/lhc_web/modules/lhuser/avatarbuilder.php b/lhc_web/modules/lhuser/avatarbuilder.php
index 4c5b139020..d20d1f6a33 100644
--- a/lhc_web/modules/lhuser/avatarbuilder.php
+++ b/lhc_web/modules/lhuser/avatarbuilder.php
@@ -1,7 +1,7 @@
 <?php
 $tpl = erLhcoreClassTemplate::getInstance('lhchat/avatarbuilder.tpl.php');
 
-$id = $Params['user_parameters']['id'];
+$id = strip_tags($Params['user_parameters']['id']);
 
 $prefix = isset($_GET['prefix']) ? strip_tags($_GET['prefix']) : '';