From fb4cbc73bae831e68fe8234811184f46077db5e6 Mon Sep 17 00:00:00 2001
From: winter
Date: Mon, 20 Jan 2025 17:48:33 +0000
Subject: fix some xss situations

---
 templates/actor_profile.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'templates/actor_profile.php')

diff --git a/templates/actor_profile.php b/templates/actor_profile.php
index 46ee273..fed8e3b 100644
--- a/templates/actor_profile.php
+++ b/templates/actor_profile.php
@@ -13,7 +13,7 @@ $user = UserAccount::findByCurrentSession();
             </a>
         <?php endif; ?>
         <div>
-            <div class="displayName"><?= $actor->displayName ?></div>
+            <div class="displayName"><?= htmlspecialchars($actor->displayName) ?></div>
             <div class="handle">@<?= $actor->getFullHandle() ?></div>
             <div class="joinedDate"><?= sprintf(__('user.profile.createdAt'), $actor->created->format('Y-m-d')) ?></div>
         </div>
@@ -25,7 +25,7 @@ $user = UserAccount::findByCurrentSession();
         </div>
     </div>
     <?php if (isset($actor->bio) && $actor->bio != '') { ?>
-        <pre class="bio"><?= $actor->bio ?></pre>
+        <pre class="bio"><?= htmlspecialchars($actor->bio) ?></pre>
     <?php } else {
         call_template('placeholder_text', ['message' => __('user.profile.bio.placeholder')]);
     } ?>
-- 
cgit v1.3