Skip to content

Commit

Permalink
Browse files Browse the repository at this point in the history
Apply sanitization to user input
  • Loading branch information
albertobeta committed Sep 19, 2021
1 parent 00ab0d4 commit 038644b
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions PodcastGenerator/admin/pg_users.php
Expand Up @@ -113,9 +113,9 @@
goto error;
}
?>
<form action="pg_users.php?change=<?= $_GET['username'] ?>" method="POST">
<form action="pg_users.php?change=<?= strip_tags($_GET['username']) ?>" method="POST">
<?= _('Username') ?>:<br>
<input type="text" name="username" value="<?= $_GET['username']; ?>" disabled> <small><?= _('You cannot edit usernames') ?></small><br>
<input type="text" name="username" value="<?= strip_tags($_GET['username']); ?>" disabled> <small><?= _('You cannot edit usernames') ?></small><br>
<?= _('New Password') ?><br>
<input type="password" name="password"><br>
<?= _('Repeat new password') ?><br>
Expand All @@ -129,7 +129,7 @@
<?php if ($_GET['username'] == $_SESSION['username']) { /* Don't permit to delete the logged in user */ ?>
<p><?= _('You cannot delete yourself') ?></p>
<?php } else { ?>
<form action="pg_users.php?delete=<?= $_GET['username'] ?>" method="POST">
<form action="pg_users.php?delete=<?= strip_tags($_GET['username']) ?>" method="POST">
<input type="hidden" name="token" value="<?= $_SESSION['token' ] ?>">
<input class="btn btn-danger" type="submit" value="<?= _('Delete') ?>">
</form>
Expand Down

0 comments on commit 038644b

Please sign in to comment.