From 94f5593f22b8f510f02d90d047d74a69d4690419 Mon Sep 17 00:00:00 2001
From: novgorodschi catalin <cata7007@gmail.com>
Date: Wed, 5 Aug 2026 10:30:33 +0300
Subject: [PATCH] Fix alliance XSS desc

Fix alliance XSS desc
---
 Templates/Alliance/overview.tpl | 24 ++++++++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/Templates/Alliance/overview.tpl b/Templates/Alliance/overview.tpl
index 67fecd68..d27ccd08 100644
--- a/Templates/Alliance/overview.tpl
+++ b/Templates/Alliance/overview.tpl
@@ -80,11 +80,31 @@ echo "<h1>" . htmlspecialchars($allianceinfo['tag']) . " - " . htmlspecialchars(
 /* =========================
    PROFILE + MEDALS
 ========================= */
-$profiel = $allianceinfo['notice'] . md5('skJkev3') . $allianceinfo['desc'];
+/**
+ * FIX SECURITATE (XSS stocat): descrierea aliantei e text liber, scris de
+ * conducerea aliantei, si se afisa oricui viziteaza pagina - fara escapare.
+ * Un <script> introdus acolo se executa in browserul fiecarui vizitator.
+ *
+ * Aceeasi problema a fost reparata la profilul de JUCATOR (vezi
+ * Templates/Profile/overview.tpl), dar varianta de alianta a fost uitata.
+ *
+ * Escapam INAINTE de procesarea medaliilor, exact ca acolo: separatorul md5 si
+ * marcajele [#..] nu contin caractere speciale HTML, deci trec neatinse prin
+ * htmlspecialchars() si medal.php le gaseste asa cum le asteapta.
+ */
+$profileSeparator = md5('skJkev3');
+
+$profiel = htmlspecialchars($allianceinfo['notice'] ?? '', ENT_QUOTES, 'UTF-8')
+         . $profileSeparator
+         . htmlspecialchars($allianceinfo['desc'] ?? '', ENT_QUOTES, 'UTF-8');
 
 require("medal.php");
 
-$profiel = explode(md5('skJkev3'), $profiel);
+$profiel = explode($profileSeparator, $profiel);
+
+// plasa de siguranta, ca la profilul de jucator
+if (!isset($profiel[0])) { $profiel[0] = ''; }
+if (!isset($profiel[1])) { $profiel[1] = ''; }
 
 include("alli_menu.tpl");
 ?>