From ccc50f11063f675777fd993fee6a2dc09600b1a3 Mon Sep 17 00:00:00 2001
From: Ahmad Gneady <support@bigprof.com>
Date: Thu, 1 Jul 2021 20:14:55 +0200
Subject: [PATCH] Fix reflected XSS vulnerability

---
 app/membership_passwordReset.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/membership_passwordReset.php b/app/membership_passwordReset.php
index 0d56f0d..57d1f2b 100644
--- a/app/membership_passwordReset.php
+++ b/app/membership_passwordReset.php
@@ -82,7 +82,7 @@
 							</div>
 						</div>
 
-						<input type="hidden" name="key" value="<?php echo $_GET['key']; ?>">
+						<input type="hidden" name="key" value="<?php echo html_attr($_GET['key']); ?>">
 					</form>
 				</div>
 			</div>