From 558643dfa5e8bfd193c6bcf19dbdea71dd35abdb Mon Sep 17 00:00:00 2001
From: Flat <flatta@outlook.jp>
Date: Thu, 30 Jun 2016 23:12:23 +0900
Subject: [PATCH] Fix XSS in Password Reset

---
 web/templates/reset_2.html | 2 +-
 web/templates/reset_3.html | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/web/templates/reset_2.html b/web/templates/reset_2.html
index d4b62a7c..58c3b94f 100644
--- a/web/templates/reset_2.html
+++ b/web/templates/reset_2.html
@@ -21,7 +21,7 @@
                                             <tr>
                                                 <td>
                                                     <input type="hidden" name="action" value="confirm">
-                                                    <input type="hidden" name="user" value="<?php echo $_GET['user'];?>">
+                                                    <input type="hidden" name="user" value="<?=htmlentities($_GET['user'], ENT_QUOTES|ENT_HTML5)?>">
                                                     <input tabindex="1" type="text" size="20px" style="width:240px" name="code" class="vst-input">
                                                 </td>
                                             </tr>
diff --git a/web/templates/reset_3.html b/web/templates/reset_3.html
index 95b31df0..0cc54bda 100644
--- a/web/templates/reset_3.html
+++ b/web/templates/reset_3.html
@@ -13,8 +13,8 @@
                                             <tr>
                                                 <td style="padding: 12px 0 0 2px;">
                                                     <input type="hidden" name="action" value="confirm" >
-                                                    <input type="hidden" name="user" value="<?php echo $_GET['user'];?>" >
-                                                    <input type="hidden" name="code" value="<?php echo $_GET['code'];?>" >
+                                                    <input type="hidden" name="user" value="<?=htmlentities($_GET['user'], ENT_QUOTES|ENT_HTML5)?>" >
+                                                    <input type="hidden" name="code" value="<?=htmlentities($_GET['code'], ENT_QUOTES|ENT_HTML5)?>" >
                                                     <?php print __('New Password');?>
                                                 </td>
                                             </tr>