diff --git a/GameEngine/Profile.php b/GameEngine/Profile.php
index 1a104194..e0b5e3ec 100755
--- a/GameEngine/Profile.php
+++ b/GameEngine/Profile.php
@@ -262,6 +262,28 @@ class Profile {
if (!isset($post['dname' . $i])) continue;
$newName = trim($post['dname' . $i]);
if ($newName === '') continue;
+
+ /**
+ * FIX SECURITATE (XSS stocat): numele satului nu era validat deloc.
+ * Un jucator putea sa-si numeasca satul "", iar
+ * numele se afiseaza in rapoarte de lupta, pe harta si in listele de
+ * sate - deci codul se executa in browserul altor jucatori.
+ *
+ * Aceleasi reguli ca la numele de cont: litere, cifre, punct, liniuta,
+ * underscore si spatii simple. Fara caractere cu inteles in HTML.
+ */
+ if (function_exists('mb_strlen')) {
+ if (mb_strlen($newName, 'UTF-8') > 25) {
+ $newName = mb_substr($newName, 0, 25, 'UTF-8');
+ }
+ } elseif (strlen($newName) > 25) {
+ $newName = substr($newName, 0, 25);
+ }
+
+ if (!preg_match('/^[\p{L}\p{N}._-]+(?: [\p{L}\p{N}._-]+)*$/u', $newName)) {
+ continue; // nume respins, satul isi pastreaza numele vechi
+ }
+
$database->setVillageName($varray[$i]['wref'], $newName);
}
diff --git a/Templates/Notice/1.tpl b/Templates/Notice/1.tpl
index 3307cbd1..7858b38e 100644
--- a/Templates/Notice/1.tpl
+++ b/Templates/Notice/1.tpl
@@ -1,10 +1,21 @@
readingNotice['data']));
diff --git a/Templates/Notice/10.tpl b/Templates/Notice/10.tpl
index 82197a4a..abcfa8da 100644
--- a/Templates/Notice/10.tpl
+++ b/Templates/Notice/10.tpl
@@ -1,10 +1,21 @@
readingNotice['data']));
diff --git a/Templates/Notice/15.tpl b/Templates/Notice/15.tpl
index b8c5bdf3..7f825674 100644
--- a/Templates/Notice/15.tpl
+++ b/Templates/Notice/15.tpl
@@ -1,10 +1,21 @@
readingNotice['data']));
diff --git a/Templates/Notice/22.tpl b/Templates/Notice/22.tpl
index 142d1bc1..1aa790ed 100644
--- a/Templates/Notice/22.tpl
+++ b/Templates/Notice/22.tpl
@@ -1,10 +1,21 @@
readingNotice['data']));
@@ -19,10 +30,12 @@ $targetId = $dataarray[2];
$type = isset($dataarray[15]) ? (int)$dataarray[15] : 0;
// CACHE DB CALLS (reduce repeated queries)
-$attackerName = $database->getUserField($attackerId, "username", 0);
+$attackerName = htmlspecialchars(
+ (string) $database->getUserField($attackerId, "username", 0), ENT_QUOTES, 'UTF-8');
$attackerUid = $database->getUserField($attackerId, "id", 0);
-$targetName = $database->getUserField($targetId, "username", 0);
+$targetName = htmlspecialchars(
+ (string) $database->getUserField($targetId, "username", 0), ENT_QUOTES, 'UTF-8');
// ======================== MESSAGE BUILD ========================
if ($type == 1) {
@@ -72,7 +85,14 @@ if ($type == 1) {
- getVillageField($dataarray[1], "name"); ?>
+ getVillageField($dataarray[1], "name"),
+ ENT_QUOTES, 'UTF-8'
+ );
+ ?>
diff --git a/Templates/Notice/24.tpl b/Templates/Notice/24.tpl
index bceba800..1219177b 100644
--- a/Templates/Notice/24.tpl
+++ b/Templates/Notice/24.tpl
@@ -1,9 +1,21 @@
readingNotice['ntype'] ?? 24);
diff --git a/Templates/Notice/26.tpl b/Templates/Notice/26.tpl
index b5929cdf..82dabc2b 100644
--- a/Templates/Notice/26.tpl
+++ b/Templates/Notice/26.tpl
@@ -1,15 +1,21 @@
readingNotice['data']));
diff --git a/Templates/Notice/8.tpl b/Templates/Notice/8.tpl
index d6cd9b27..1fb73809 100644
--- a/Templates/Notice/8.tpl
+++ b/Templates/Notice/8.tpl
@@ -1,10 +1,21 @@
readingNotice['data']));
diff --git a/Templates/Notice/9.tpl b/Templates/Notice/9.tpl
index 21508784..926f3498 100644
--- a/Templates/Notice/9.tpl
+++ b/Templates/Notice/9.tpl
@@ -1,11 +1,21 @@