Use htmlspecialchars on Message to prevent Stored Cross-Site Scriptin…

…g. Fixes GHSA-rqxv-447h-g7jx
ZoneMinder · Sep 30, 2024 · 36c6b88 · 36c6b88
1 parent 7cc4ac2
commit 36c6b88
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/web/ajax/log.php b/web/ajax/log.php
@@ -162,7 +162,7 @@ function queryRequest() {
 
     $row['Server'] = $Server ? $Server->Name() : '';
     // Strip out all characters that are not ASCII 32-126 (yes, 126)
-    $row['Message'] = preg_replace('/[^\x20-\x7E]/', '', $row['Message']);
+    $row['Message'] = preg_replace('/[^\x20-\x7E]/', '', htmlspecialchars($row['Message']));
     $row['File'] = preg_replace('/[^\x20-\x7E]/', '', strip_tags($row['File']));
     $rows[] = $row;
   }