Author: Derick Rethans (derickr)
Date: 2026-11-09T11:19:50Z
Commit:
https://github.com/php/web-master/commit/ebba0fae3c6dab5b67c68e4d332db81825ad63e1
Raw diff:
https://github.com/php/web-master/commit/ebba0fae3c6dab5b67c68e4d332db81825ad63e1.diff
Be extra careful with user-supplied name and email
Changed paths:
M public/manage/users.php
Diff:
diff --git a/public/manage/users.php b/public/manage/users.php
index b065434..64d5369 100644
--- a/public/manage/users.php
+++ b/public/manage/users.php
@@ -182,11 +182,11 @@ function csrf_validate(&$mydata, $name) {
<tbody>
<tr>
<th>Name:</th>
- <td><input type="text" name="in[name]" value="<?php echo
$userdata['name'];?>" size="40" maxlength="255" /></td>
+ <td><input type="text" name="in[name]" value="<?php echo
hsc($userdata['name']);?>" size="40" maxlength="255" /></td>
</tr>
<tr>
<th>Email:</th>
- <td><input type="text" name="in[email]" value="<?php echo
$userdata['email'];?>" size="40" maxlength="255" /><br/>
+ <td><input type="text" name="in[email]" value="<?php echo
hsc($userdata['email']);?>" size="40" maxlength="255" /><br/>
<input type="checkbox" name="in[enable]"<?php echo $userdata['enable']
? " checked" : "";?> /> Enable email for my account.
</td>
</tr>
