From 388d6f0ca3d44faa0927ba7b4afee91691dac9c7 Mon Sep 17 00:00:00 2001
From: ail1020 <ail1020@users.noreply.github.com>
Date: Thu, 27 May 2021 18:52:53 -0500
Subject: [PATCH 1/2] Update dissociated-press.inc.php

Address XSS when placed in URL by attacker
---
 dissociated-press.inc.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dissociated-press.inc.php b/dissociated-press.inc.php
index 5bafd79..cd53776 100644
--- a/dissociated-press.inc.php
+++ b/dissociated-press.inc.php
@@ -178,7 +178,7 @@ function ProcessText($text, $directory){
 				}
 			}
 
-			return '<a href="' . $directory . '/' . $link . '">' . $text . '</a> ';
+			return '<a href="' . htmlentities($directory) . '/' . $link . '">' . $text . '</a> ';
 		}else{
 			return "$text";
 		}

From d99b480366d1b76b4a02eb8c3cb97747fdeacd6f Mon Sep 17 00:00:00 2001
From: ail1020 <ail1020@users.noreply.github.com>
Date: Thu, 27 May 2021 18:55:09 -0500
Subject: [PATCH 2/2] Update index.php

Address XSS when injected in URL
---
 index.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/index.php b/index.php
index 00f713a..fb9242b 100644
--- a/index.php
+++ b/index.php
@@ -102,7 +102,7 @@
 ?>
 
 <link rel="stylesheet" type="text/css" href="<?php print $config['web_path']; ?>/labyrinth.css">
-<title><?php print basename($_SERVER['REQUEST_URI']); ?></title>
+<title><?php print htmlentities(basename($_SERVER['REQUEST_URI'])); ?></title>
 <body>
 	<?php 
 		// Print the text with links