cleaning REQUEST_URI for good measure

8 years ago · e7dde4d212
parent e1d6db88a1
commit e7dde4d212
1 changed files with 2 additions and 1 deletions
--- a/lib/privatebin.php
+++ b/lib/privatebin.php
@ -176,7 +176,8 @@ class privatebin
        $this->_conf = new configuration;
        $this->_model = new model($this->_conf);
        $this->_request = new request;
-        $this->_urlbase = array_key_exists('REQUEST_URI', $_SERVER) ? $_SERVER['REQUEST_URI'] : '/';
+        $this->_urlbase = array_key_exists('REQUEST_URI', $_SERVER) ?
+            htmlspecialchars($_SERVER['REQUEST_URI']) : '/';

        // set default language
        $lang = $this->_conf->getKey('languagedefault');