修复 XSS漏洞（补充）

2017-10-20 23:06:22 +08:00 · 2017-10-20 23:06:22 +08:00 · a90b72af51
parent 19fd20f742
commit a90b72af51
1 changed files with 1 additions and 1 deletions
--- a/upload/template/default/ranklist/ranklist.htm
+++ b/upload/template/default/ranklist/ranklist.htm
@ -37,7 +37,7 @@
 				<!--{eval unset($memberlist[0]);}-->
 				<!--{loop $memberlist $member}-->
 					<li>
-						<a href="home.php?mod=space&uid=$member[uid]&do=profile" target="_blank" id="bid_$member[uid]" {if $member[note]} onmouseover="showTip(this)" tip="$member[username]: $member[note]"{/if}>$member[avatar]</a>
+						<a href="home.php?mod=space&uid=$member[uid]&do=profile" target="_blank" id="bid_$member[uid]" {if $member[note]} onmouseover="showTip(this)" tip="$member[username]: {echo htmlspecialchars($member[note])}"{/if}>$member[avatar]</a>
 					</li>
 				<!--{/loop}-->
 				</ul>