advocaite/Travianx — Issue #46: Messages not safe for xss
Author: Ansem
Created: 2011-11-18 19:11:39+00:00
State: open

You can insert code and other stuff in the inbox.
For example, my friend was able to send me a message, which if open results in a popup box "I'm an alert box".

Messages should be stripped for all tags except plain text and emoticons.