fix(admin): escape stored player values in admin templates [#139] (#272)

2026-07-21 20:16:11 +00:00 · 2026-06-23 21:00:51 +02:00
parent 90c5cdd97c
commit c0bbf2bfbe
12 changed files with 19 additions and 19 deletions
@@ -49,7 +49,7 @@ if($id){
 	<input type="hidden" name="did" id="did" value="<?php echo (int)($_GET['did'] ?? 0); ?>">
    
    <div class="res-card">
-      <div class="res-head">Modify Resources — <?php echo $village['name']; ?> (<?php echo $coor['x']; ?>|<?php echo $coor['y']; ?>)</div>
+      <div class="res-head">Modify Resources — <?php echo htmlspecialchars($village['name']); ?> (<?php echo $coor['x']; ?>|<?php echo $coor['y']; ?>)</div>
      
      <table class="res-table">
        <thead>