Issue #14 : XSS fix

flatpressblog · Mar 6, 2014 · 924668f · 924668f
1 parent 1096648
commit 924668f
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/fp-interface/sharedtpls/comment-form.tpl b/fp-interface/sharedtpls/comment-form.tpl
@@ -33,6 +33,7 @@
 		<label class="textlabel" for="url">{$lang.comments.www}</label>
 		</p>
 
+		{* do action *}
 		{comment_form}
 
 	</div>
@@ -42,7 +43,7 @@
 
 	<div class="comment-content">
 			<p><textarea name="content" {$error.content|notempty:'class="field-error"'}
-			id="content" rows="10" cols="74">{$values.content}</textarea></p>
+			id="content" rows="10" cols="74">{$values.content|wp_specialchars:1}</textarea></p>
 			{*here will go a plugin hook*}
 	</div>