From 2f620c10ff103febf2b450799faad529db1e3b00 Mon Sep 17 00:00:00 2001
From: root <root@www.cacert.org>
Date: Sun, 28 Jan 2007 18:36:19 +0000
Subject: [PATCH] Fixed XSS Exploits. Thanks to ascii for reporting them

---
 pages/wot/5.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pages/wot/5.php b/pages/wot/5.php
index 4e203db..d11bc71 100644
--- a/pages/wot/5.php
+++ b/pages/wot/5.php
@@ -17,7 +17,7 @@
 <? if($_SESSION['_config']['error'] != "") { ?><div color="orange"><?=_("ERROR")?>: <?=$_SESSION['_config']['error']?></div><? unset($_SESSION['_config']['error']); } ?>
 <? if($_SESSION['_config']['noemailfound'] == 1) { ?>
 <form method="post" action="wot.php">
-<input type="hidden" name="email" value="<?=$_POST['email']?>"><br>
+<input type="hidden" name="email" value="<?=strip_tags($_POST['email'])?>"><br>
 <select name="reminder-lang">
 <?
 	if($_SESSION['_config']['reminder-lang'] == "")
@@ -45,7 +45,7 @@
 <? if($_SESSION['_config']['remindersent'] == 1) { unset($_SESSION['_config']['remindersent']) ?>
     <td class="DataTD"><input type="text" name="email" id="email" value=""></td>
 <? } else { ?>
-    <td class="DataTD"><input type="text" name="email" id="email" value="<?=$_POST['email']?>"></td>
+    <td class="DataTD"><input type="text" name="email" id="email" value="<?=strip_tags($_POST['email'])?>"></td>
 <? } ?>
   </tr>
   <tr>