From 343a2b47e164dd9090a3c9477ef273f0efa16a7d Mon Sep 17 00:00:00 2001
From: JediKev <kevin@enhancesoft.com>
Date: Wed, 8 Mar 2023 10:53:55 -0600
Subject: [PATCH] xss: AJAX Paths

This mitigates a vulnerability reported by indevi0us where XSS is
possible via some AJAX paths.
---
 include/class.osticket.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/class.osticket.php b/include/class.osticket.php
index 98e660e184..2835f6dbfc 100644
--- a/include/class.osticket.php
+++ b/include/class.osticket.php
@@ -366,10 +366,10 @@ function get_db_input($index, $vars, $quote=true) {
 
     static function get_path_info() {
         if(isset($_SERVER['PATH_INFO']))
-            return $_SERVER['PATH_INFO'];
+            return htmlentities($_SERVER['PATH_INFO']);
 
         if(isset($_SERVER['ORIG_PATH_INFO']))
-            return $_SERVER['ORIG_PATH_INFO'];
+            return htmlentities($_SERVER['ORIG_PATH_INFO']);
 
         //TODO: conruct possible path info.