Uploaded image for project: 'phpBB'
  1. phpBB
  2. PHPBB-6453

missing escaping when quoting posts

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Fixed
    • 3.0.0
    • 3.0.RC7
    • Posting
    • None
    • PHP Environment:
      Database:

      In posting.php there is this:

      if ($mode == 'quote' && !$submit && !$preview && !$refresh)
      		 
      {
      		 
      	$message_parser->message = '[quote="' . $post_data['quote_username'] . '"]' . censor_text(trim($message_parser->message)) . "[/quote]\n";
      		 
      }

      When quoting a post, this is not escaped properly, it should be ".

            Acyd Burn Meik Sievertsen [X] (Inactive)
            igorw Igor Wiedler [X] (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

              Created:
              Updated:
              Resolved: