Changeset 4249 for trunk/licqweb

Timestamp:

10/03/05 12:06:27 (3 years ago)

Author:

phatfil

Message:

whoops. do kses on users nicks properly.

Files:

• trunk/licqweb/push.php (modified) (2 diffs)

trunk/licqweb/push.php

@@ -101 +101 @@
             $user = getUserStuff($packet);
             $method = "updateStatus";
-            $txt = "<newstatus><id>" . xmlentities($user['id']) . "</id><pp>" . xmlentities($user['pp']) . "</pp><nick>" . str_replace("\n", '', xmlentities($user['nick'])) . "</nick><nummsgs>" . trim(xmlentities($user['newmsgs'])) . "</nummsgs><status>" . str_replace(' ', '', xmlentities($user['status'])) . "</status></newstatus>";
+            $txt = "<newstatus><id>" . xmlentities($user['id']) . "</id><pp>" . xmlentities($user['pp']) . "</pp><nick>" . str_replace("\n", '', xmlentities(kses($user['nick']))) . "</nick><nummsgs>" . trim(xmlentities($user['newmsgs'])) . "</nummsgs><status>" . str_replace(' ', '', xmlentities($user['status'])) . "</status></newstatus>";
             break;
         case CODE_NOTIFYxMESSAGE:
@@ -118 +118 @@
         <response>
           <method>$method</method>
-          <result>" . kses($txt) . "</result>
+          <result>$txt</result>
         </response>
     ";