rrodriguez 15 ani în urmă
părinte
comite
4c458f0a24
1 a modificat fișierele cu 1 adăugiri și 0 ștergeri
  1. 1 0
      main/inc/lib/message.lib.php

+ 1 - 0
main/inc/lib/message.lib.php

@@ -234,6 +234,7 @@ class MessageManager
 	        $subject = Database::escape_string($subject);
 	        $subject = Database::escape_string($subject);
 	        $content = api_convert_encoding($content,$charset);
 	        $content = api_convert_encoding($content,$charset);
 	        $content = Database::escape_string($content);
 	        $content = Database::escape_string($content);
+	        $content = Security::remove_XSS($content);
 			
 			
 			//useless query
 			//useless query
 			//echo $sql = "SELECT COUNT(*) as count FROM $table_message WHERE user_sender_id = ".$user_sender_id." AND user_receiver_id='$receiver_user_id' AND title = '$title' AND content ='$content' AND group_id = '$group_id' AND parent_id = '$parent_id'";		
 			//echo $sql = "SELECT COUNT(*) as count FROM $table_message WHERE user_sender_id = ".$user_sender_id." AND user_receiver_id='$receiver_user_id' AND title = '$title' AND content ='$content' AND group_id = '$group_id' AND parent_id = '$parent_id'";