Incubator » CB GroupJive

Fixed with r1606

Same applies to values of inputs:
e.g. line 581:

            $input['name']                =    '<input type="text" id="name" name="name" value="' . $config->get( 'name' ) . '" class="inputbox" size="40" />';

should be:

            $input['name']                =    '<input type="text" id="name" name="name" value="' . htmlspecialchars( $config->get( 'name' ) ) . '" class="inputbox" size="40" />';

Actually, not only for values of inputs, but all html output from PHP should be htmlspecialchared where applicable. Otherwise you can have html and javascript injections.

Fixed with r1607