diff options
| -rw-r--r-- | CHANGELOG | 2 | ||||
| -rw-r--r-- | program/steps/settings/save_identity.inc | 4 |
2 files changed, 4 insertions, 2 deletions
@@ -68,3 +68,5 @@ CHANGELOG RoundCube Webmail - Set default user language from config 'locale_string' - Added sorting patch for message list - Make default sort col/order configurable +- Fixed XSS in address book and identities + diff --git a/program/steps/settings/save_identity.inc b/program/steps/settings/save_identity.inc index 680833d7c..ea186ec12 100644 --- a/program/steps/settings/save_identity.inc +++ b/program/steps/settings/save_identity.inc @@ -33,7 +33,7 @@ if ($_POST['_iid']) if (!isset($_POST[$fname])) continue; - $a_write_sql[] = sprintf("`%s`='%s'", $col, addslashes($_POST[$fname])); + $a_write_sql[] = sprintf("`%s`='%s'", $col, addslashes(strip_tags($_POST[$fname]))); } if (sizeof($a_write_sql)) @@ -87,7 +87,7 @@ else continue; $a_insert_cols[] = $DB->quoteIdentifier($col); - $a_insert_values[] = sprintf("'%s'", addslashes($_POST[$fname])); + $a_insert_values[] = sprintf("'%s'", addslashes(strip_tags($_POST[$fname]))); } if (sizeof($a_insert_cols)) |