From e771690542fd648ae85efa35e0dd034a7d9fae0f Mon Sep 17 00:00:00 2001
From: Th3-822 <Th3-822@users.noreply.github.com>
Date: Tue, 7 Sep 2021 16:21:25 -0400
Subject: [PATCH] Fixed XSS on unrar option reported by wtwver

---
 classes/options/unrar.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/classes/options/unrar.php b/classes/options/unrar.php
index 6f26303c..21fdc7c7 100644
--- a/classes/options/unrar.php
+++ b/classes/options/unrar.php
@@ -52,7 +52,7 @@ function unrar_setCheckboxes(act, filestounrar) {
       elseif ($rar_list[0] == 'ERROR') { printf(lang(370),$rar_list[1].' '.$rar_list[2]); }
     }
 ?>
-                <input type="<?php echo ($rar_list['NEEDP'] == true) ? 'password' : 'hidden'; ?>" name="passwords[]" value="<?php echo $_GET['passwords'][$i]; ?>" />
+                <input type="<?php echo ($rar_list['NEEDP'] == true) ? 'password' : 'hidden'; ?>" name="passwords[]" value="<?php echo htmlspecialchars($_GET['passwords'][$i], ENT_QUOTES); ?>" />
                 &nbsp;
               </td>
             </tr>