fix(admin): escape stored player values in admin templates [#139] (#272)

2026-08-14 15:21:01 +00:00 · 2026-06-23 21:00:51 +02:00
parent 90c5cdd97c
commit c0bbf2bfbe
12 changed files with 19 additions and 19 deletions
@@ -5,7 +5,7 @@
        <strong style="color:#e67e22;"><?php echo $delTime; ?></strong>
    </div>
    <a href="?p=player&uid=<?php echo $user['id']; ?>&action=StopDel" 
-       onclick="return confirm('Cancel deletion for <?php echo $user['username']; ?>?');"
+       onclick="return confirm('Cancel deletion for <?php echo htmlspecialchars(addslashes($user['username'])); ?>?');"
       title="Cancel deletion"
       style="background:#e74c3c; color:#fff; text-decoration:none; padding:6px 10px; border-radius:6px; font-weight:bold;">
       ✖ Cancel