From 89901a378a849ee17780c52fa73ee5b14049425c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Felix=20D=C3=B6rre?= <felix@dogcraft.de>
Date: Sun, 27 Jul 2014 12:49:28 +0200
Subject: bug 1291: Fix XSS in WoT 15

---
 includes/notary.inc.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/includes/notary.inc.php b/includes/notary.inc.php
index f15e09e..3b8e736 100644
--- a/includes/notary.inc.php
+++ b/includes/notary.inc.php
@@ -502,7 +502,7 @@ define('THAWTE_REVOCATION_DATETIME', '2010-11-16 00:00:00');
 ?>
 		<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$name?><?=$emclose?></td>
 		<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$revoked ? sprintf("<strong style='color: red'>%s</strong>",_("Revoked")) : $awarded?><?=$emclose?></td>
-		<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$location?><?=$emclose?></td>
+		<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=sanitizeHTML($location)?><?=$emclose?></td>
 		<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$method?><?=$emclose?></td>
 		<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$experience?$experience:'&nbsp;'?><?=$emclose?></td>
 <?
-- 
cgit v1.2.1