Added XSS protection

pages/account/19.php

@@ -18,7 +18,7 @@
 <?
 	$certid = 0; if(array_key_exists('cert',$_REQUEST)) $certid=intval($_REQUEST['cert']);
 
-	$query = "select * from `orgemailcerts`,`org` where `orgemailcerts`.`id`='$certid' and
+	$query = "select * from `orgemailcerts`,`org` where `orgemailcerts`.`id`='".intval($certid)."' and
 			`org`.`memid`='".intval($_SESSION['profile']['id'])."' and
 			`org`.`orgid`=`orgemailcerts`.`orgid`";
 	$res = mysql_query($query);
@@ -39,7 +39,9 @@
 		{
 			header("Content-Type: application/x-x509-user-cert");
 			header("Content-Length: ".strlen($cert));
-			header('Content-Disposition: inline; filename="'.$row['CN'].'.crt"');
+			$fname=sanitizeFilename($row['CN']);
+			if($fname=="") $fname="certificate";
+			header('Content-Disposition: inline; filename="'.$fname.'.crt"');
 			echo $cert;
 			exit;
 		} else {