fix(admin): escape reflected request params in admin templates [#139] (#270)

2026-08-28 14:17:15 +00:00 · 2026-06-23 16:37:11 +02:00
parent e17bb3dec6
commit 749a55aaf5
12 changed files with 23 additions and 23 deletions
@@ -76,7 +76,7 @@ $_SESSION['mass_color']   = $_SESSION['mass_color'] ?? 'black';
 <?php elseif(isset($_GET['sending'])):?>
    <div style="text-align:center;padding:30px">
      <div style="font-size:16px;margin-bottom:10px">Sending messages...</div>
-      <div style="color:#666"><?=$_GET['msg']?? ''?></div>
+      <div style="color:#666"><?=e($_GET['msg'] ?? '')?></div>
    </div>

 <?php else:?>