xinyin025/TravianZ
1
0
Fork 0
mirror of https://github.com/Shadowss/TravianZ.git synced 2026-07-13 08:06:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(admin): escape stored player values in admin templates [#139] (#272)

Browse Source
This commit is contained in:
Ferywir
2026-06-23 21:00:51 +02:00
committed by GitHub
parent 90c5cdd97c
commit c0bbf2bfbe
12 changed files with 19 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Admin/Templates/msg.tpl
+2 -2
View File
@@ -41,14 +41,14 @@ if($nid > 0){
<link href="../<?php echo GP_LOCATE;?>travian.css?e21d2" rel="stylesheet" type="text/css">
<div style="max-width:900px;margin:20px auto">
<a href="?p=msg" style="font-size:12px">← Back to messages</a>
<div style="margin:8px 0;font-size:12px"><span class="b">Sent to</span>: <?php echo $database->getUserField($msg[0]['target'],'username',0);?></div>
<div style="margin:8px 0;font-size:12px"><span class="b">Sent to</span>: <?php echo htmlspecialchars($database->getUserField($msg[0]['target'],'username',0));?></div>
<div id="content" class="messages">
<h1>Message</h1>
<div id="read_head" class="msg_head"></div>
<div id="read_content" class="msg_content">
<img src="../img/x.gif" id="label" class="read" alt="">
<div id="heading">
<div><?php echo $database->getUserField($msg[0]['owner'],'username',0);?></div>
<div><?php echo htmlspecialchars($database->getUserField($msg[0]['owner'],'username',0));?></div>
<div><?php echo htmlspecialchars($msg[0]['topic']);?></div>
</div>
<div id="time">