fix for fc_clean_permalink

See issue #70 and https://www.huntr.dev/bounties/3c293dca-d6ba-41b7-8954-8749d729a150/
flatCore · Oct 12, 2021 · a2688ab · a2688ab
1 parent e64999d
commit a2688ab
Showing 1 changed file with 5 additions and 4 deletions.
diff --git a/acp/core/functions.php b/acp/core/functions.php
@@ -386,13 +386,14 @@ function fc_return_clean_value($string) {
 }
 
 function fc_clean_permalink($str) {
-
+	$str = stripslashes($str);
+	$str = strip_tags($str);
 	$str = strtolower($str);
-	$a = array('ä','ö','ü','ß',' + ','//','(',')',';','\'','\\'); 
-	$b = array('ae','oe','ue','ss','-'.'/','','','','','');
+	$a = array('ä','ö','ü','ß',' + ','//','(',')',';','\'','\\','.','`','<','>'); 
+	$b = array('ae','oe','ue','ss','-'.'/','','','','','','','','','');
 	$str = str_replace($a, $b, $str);
 	$str = preg_replace('/\s/s', '_', $str);  // replace blanks -> '_'
-	$string = htmlentities($string);
+	$str = htmlentities($str, ENT_QUOTES, "UTF-8");
 	$str = trim($str);
 
 	return $str;