From 10e9d80f48b2504a1461a5bee443ccdcc81ab96a Mon Sep 17 00:00:00 2001
From: root <root@www.cacert.org>
Date: Tue, 3 Jul 2007 19:50:16 +0000
Subject: [PATCH] Fixed XSS

---
 pages/account/33.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pages/account/33.php b/pages/account/33.php
index 51a2cdd..a66b845 100644
--- a/pages/account/33.php
+++ b/pages/account/33.php
@@ -18,14 +18,14 @@
 	$row = mysql_fetch_assoc(mysql_query($query));
 ?>
 <form method="post" action="account.php">
-<input type="hidden" name="orgid" value="<?=$_REQUEST['orgid']?>">
+<input type="hidden" name="orgid" value="<?=intval($_REQUEST['orgid'])?>">
 <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
   <tr>
     <td colspan="2" class="title"><? printf(_("New Admin for %s"), $row[O]); ?></td>
   </tr>
   <tr>
     <td class="DataTD"><?=_("Email")?>:</td>
-    <td class="DataTD"><input type="text" name="email" value="<?=$_SESSION['_config']['email']?>"></td>
+    <td class="DataTD"><input type="text" name="email" value="<?=sanitizeHTML($_SESSION['_config']['email'])?>"></td>
   </tr>
   <tr>
     <td class="DataTD"><?=_("Department")?>:</td>