From 3edc6c510bc8131410126133c099f433eb57934f Mon Sep 17 00:00:00 2001
From: Ahmad Gneady <support@bigprof.com>
Date: Sun, 4 Jul 2021 14:25:55 +0200
Subject: [PATCH] prevent low severity xss in member profile.

---
 app/membership_profile.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/membership_profile.php b/app/membership_profile.php
index 81d1bcc..5fc868c 100644
--- a/app/membership_profile.php
+++ b/app/membership_profile.php
@@ -111,7 +111,7 @@
 	include_once("$currDir/header.php"); ?>
 
 	<div class="page-header">
-		<h1><?php echo sprintf($Translation['Hello user'], $mi['username']); ?></h1>
+		<h1><?php echo sprintf($Translation['Hello user'], htmlspecialchars($mi['username'])); ?></h1>
 	</div>
 	<div id="notify" class="alert alert-success" style="display: none;"></div>
 	<div id="loader" style="display: none;"><i class="glyphicon glyphicon-refresh"></i> <?php echo $Translation['Loading ...']; ?></div>
@@ -223,7 +223,7 @@
 				<div class="panel-body">
 					<div class="form-group">
 						<label><?php echo $Translation['group']; ?></label>
-						<div class="form-control-static"><?php echo $mi['group']; ?></div>
+						<div class="form-control-static"><?php echo htmlspecialchars($mi['group']); ?></div>
 					</div>
 				</div>
 			</div>