Fixed XSS exploit in install script

Added htmlspecialchars() to "step" variable.
paintballrefjosh · Mar 4, 2017 · 4509beb · 4509beb · paintballrefjosh · Mar 4, 2017
1 parent 6be7801
commit 4509beb
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/install/index.php b/install/index.php
@@ -30,9 +30,10 @@ function output_message($type, $text)
 		<div class="content">				
 			<div class="content-header">
 			<?php
+
 				if(isset($_GET['step']))
 				{
-					$step = $_GET['step'];
+					$step = htmlspecialchars($_GET['step']);
 				}
 				else
 				{