Fix dumb exploit that allowed arbitrary HTML in profile blocks (whoops)

RedEnchilada · Feb 19, 2015 · 62f42bc · 62f42bc
1 parent 9ff7c22
commit 62f42bc
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/lib/profileblock.php b/lib/profileblock.php
@@ -106,7 +106,7 @@ function showDescription()
             $this->out->elementStart(
                 'p',
                 'profile_block_description');
-            $this->out->raw(preg_replace('/\r?\n/', '<br />', $description));
+            $this->out->raw(preg_replace('/\r?\n/', '<br />', htmlspecialchars($description)));
             $this->out->elementEnd('p');
         }
     }