Merge pull request #62 from cypherbits/fix-session-xss

Fix XSS in session variables.
2020-05-07 20:28:10 +02:00
parent 0f3a04b4de 81b8b78df0
commit 9c5e879d7d
1 changed files with 1 additions and 0 deletions
--- a/chat.php
+++ b/chat.php
@ -45,6 +45,7 @@ load_config();
 if(!isset($_REQUEST['session']) && isset($_COOKIE[COOKIENAME])){
 	$_REQUEST['session']=$_COOKIE[COOKIENAME];
 }
+$_REQUEST['session'] = preg_replace('/[^0-9a-zA-Z]/', '', $_REQUEST['session']);
 load_lang();
 check_db();
 cron();