From 1549f830aa4246480e7bb7090c9d394b54bf280b Mon Sep 17 00:00:00 2001
From: nixpc <nixpca@netc.eu>
Date: Thu, 6 Jul 2023 23:13:22 +0200
Subject: [PATCH] Fix CVE-2023-36995 name change alliance

---
 GameEngine/Database.php | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/GameEngine/Database.php b/GameEngine/Database.php
index 3d150f0f..ea50e18e 100755
--- a/GameEngine/Database.php
+++ b/GameEngine/Database.php
@@ -3016,6 +3016,8 @@ class MYSQLi_DB implements IDbConnection {
 
 	function setAlliName($aid, $name, $tag) {
 	    list($aid, $name, $tag) = $this->escape_input((int) $aid, $name, $tag);
+        $name = $this->RemoveXSS($name);
+        $name = $this->RemoveXSS($tag);
 
 		$q = "UPDATE " . TB_PREFIX . "alidata set name = '$name', tag = '$tag' where id = $aid";
 		return mysqli_query($this->dblink,$q);