[livejournal] r15624: LJSUP-4776: XSS vulnerability in inbox/c...

U   trunk/htdocs/inbox/compose.bml

Modified: trunk/htdocs/inbox/compose.bml
===================================================================
--- trunk/htdocs/inbox/compose.bml	2009-08-21 07:32:19 UTC (rev 15623)
+++ trunk/htdocs/inbox/compose.bml	2009-08-21 09:06:49 UTC (rev 15624)
@@ -237,7 +237,7 @@
     $body .= "</p>\n";
     $body .= "<div class='msg_txt'>";
     $body .= "<textarea name='msg_body' rows=6 cols=55 wrap=soft>";
-    $body .= $POST{'msg_body'} || $msg_body;
+    $body .= LJ::strip_html($POST{'msg_body'} || $msg_body);
     $body .= "</textarea><br />";
     $body .= "<span class='helper'>Up to " . LJ::commafy($msg_limit) . " characters. Plain text, no HTML.";
     $body .= "</span></div>\n";