Merge branch 'develop'

xpressengine · Aug 1, 2018 · a47a81c · a47a81c
2 parents 36c5e5c + 124d119
commit a47a81c
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/config/func.inc.php b/config/func.inc.php
@@ -479,7 +479,7 @@ function getFullSiteUrl()
 function getCurrentPageUrl()
 {
 	$protocol = $_SERVER['HTTPS'] == 'on' ? 'https://' : 'http://';
-	$url = $protocol . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
+	$url = $protocol . $_SERVER['HTTP_HOST'] . preg_replace('/[<>"]/', '', $_SERVER['REQUEST_URI']);
 	return htmlspecialchars($url, ENT_COMPAT, 'UTF-8', FALSE);
 }
 
@@ -1365,7 +1365,7 @@ function getScriptPath()
  */
 function getRequestUriByServerEnviroment()
 {
-	return str_replace('<', '&lt;', $_SERVER['REQUEST_URI']);
+	return str_replace('<', '&lt;', preg_replace('/[<>"]/', '', $_SERVER['REQUEST_URI']));
 }
 
 /**