CVE-2023-0607: Fix XSS when changing template · projectsend/projectsend@698be4a

@@ -10,10 +10,17 @@

$active_nav = 'templates’;

include_once ADMIN_VIEWS_DIR . DS . 'header.php’;

$templates = look_for_templates();

$valid_templates = array_map(function($t) { return $t[‘location’]; }, $templates);

/**

* Changing the client’s template

*/

if (isset($_GET[‘activate_template’])) {

if (!in_array($_GET[‘activate_template’], $valid_templates)) {

exit_with_error_code(403);

}

$save = save_option('selected_clients_template’, $_GET[‘activate_template’]);

global $flash;

@@ -28,8 +35,6 @@

ps_redirect(BASE_URI . ‘templates.php’);

}

$templates = look_for_templates();

?>

<div class="row">

<div class="col-12 col-sm-12 col-lg-12">