fix some xss situations

1 files changed, 2 insertions, 2 deletions

diff --git a/templates/actor_profile.php b/templates/actor_profile.php
index 46ee273..fed8e3b 100644
--- a/templates/actor_profile.php
+++ b/templates/actor_profile.php
@@ -13,7 +13,7 @@ $user = UserAccount::findByCurrentSession();
             </a>
         <?php endif; ?>
         <div>
-            <div class="displayName"><?= $actor->displayName ?></div>
+            <div class="displayName"><?= htmlspecialchars($actor->displayName) ?></div>
             <div class="handle">@<?= $actor->getFullHandle() ?></div>
             <div class="joinedDate"><?= sprintf(__('user.profile.createdAt'), $actor->created->format('Y-m-d')) ?></div>
         </div>
@@ -25,7 +25,7 @@ $user = UserAccount::findByCurrentSession();
         </div>
     </div>
     <?php if (isset($actor->bio) && $actor->bio != '') { ?>
-        <pre class="bio"><?= $actor->bio ?></pre>
+        <pre class="bio"><?= htmlspecialchars($actor->bio) ?></pre>
     <?php } else {
         call_template('placeholder_text', ['message' => __('user.profile.bio.placeholder')]);
     } ?>