xinyin025/TravianZ
1
0
Fork 0
mirror of https://github.com/Shadowss/TravianZ.git synced 2026-07-25 05:56:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(admin): escape stored player values in admin templates [#139] (#272)

Browse Source
This commit is contained in:
Ferywir
2026-06-23 21:00:51 +02:00
committed by GitHub
parent 90c5cdd97c
commit c0bbf2bfbe
12 changed files with 19 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Admin/Templates/Newmessage.tpl
+2 -2
View File
@@ -50,7 +50,7 @@ $user = $database->getUserArray($id,1);
<div class="msg-card">
<div class="msg-head">
<h4>New Message</h4>
<div>to <a href="admin.php?p=player&uid=<?php echo $user['id']; ?>"><?php echo $user['username']; ?></a></div>
<div>to <a href="admin.php?p=player&uid=<?php echo $user['id']; ?>"><?php echo htmlspecialchars($user['username']); ?></a></div>
</div>
<form method="post" action="../GameEngine/Admin/Mods/sendMessage.php" name="msg">
@@ -60,7 +60,7 @@ $user = $database->getUserArray($id,1);
<div class="msg-row">
<div class="msg-label">Recipient</div>
<div><strong style="color:#0f172a"><?php echo $user['username']; ?></strong> (UID <?php echo $id; ?>)</div>
<div><strong style="color:#0f172a"><?php echo htmlspecialchars($user['username']); ?></strong> (UID <?php echo $id; ?>)</div>
</div>
<div class="msg-row">