Fix persistent XSS vulnerabilities in AJAX editing

Based on merge request #22 from Jean-Lou Hau, but does the escaping for
everything and in a different place.

1 files changed, 4 insertions, 0 deletions

diff --git a/server/ajax.server.php b/server/ajax.server.php
index 52175876..80609567 100644
--- a/server/ajax.server.php
+++ b/server/ajax.server.php
@@ -158,6 +158,10 @@ switch ($_REQUEST['action']) {
         ob_end_clean();
     break;
     case 'edit_object':
+        // Scrub the data
+        foreach ($_POST as $key => $data) {
+            $_POST[$key] = scrub_in($data);
+        }
 
         $level = '50';