From 81b8b78df026a62067548b9b36b198799cbe5385 Mon Sep 17 00:00:00 2001
From: cypherbits <info@avanix.es>
Date: Sun, 3 May 2020 11:13:52 +0200
Subject: [PATCH] Fix XSS in session variables.

---
 chat.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/chat.php b/chat.php
index 172d838..1aba849 100644
--- a/chat.php
+++ b/chat.php
@@ -45,6 +45,7 @@ load_config();
 if(!isset($_REQUEST['session']) && isset($_COOKIE[COOKIENAME])){
 	$_REQUEST['session']=$_COOKIE[COOKIENAME];
 }
+$_REQUEST['session'] = preg_replace('/[^0-9a-zA-Z]/', '', $_REQUEST['session']);
 load_lang();
 check_db();
 cron();