Fixed XSS on unrar option

reported by wtwver
Th3-822 · Sep 7, 2021 · e771690 · e771690
1 parent 8b478d3
commit e771690
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/classes/options/unrar.php b/classes/options/unrar.php
@@ -52,7 +52,7 @@ function unrar_setCheckboxes(act, filestounrar) {
       elseif ($rar_list[0] == 'ERROR') { printf(lang(370),$rar_list[1].' '.$rar_list[2]); }
     }
 ?>
-                <input type="<?php echo ($rar_list['NEEDP'] == true) ? 'password' : 'hidden'; ?>" name="passwords[]" value="<?php echo $_GET['passwords'][$i]; ?>" />
+                <input type="<?php echo ($rar_list['NEEDP'] == true) ? 'password' : 'hidden'; ?>" name="passwords[]" value="<?php echo htmlspecialchars($_GET['passwords'][$i], ENT_QUOTES); ?>" />
                 &nbsp;
               </td>
             </tr>