joindin/joind.in — pull request #745 by dstockto (2013-05-26 07:59:08+00:00)
Title: Escaping some outputs to prevent or cause XSS to be more difficult.

Someone opened a ticket about talk titles not being escaped which was found during Tek. That one spot got fixed but I guessed that there were some other places that would be vulnerable to XSS. It turns out that it was true.

This pull request escapes the output for several different fields that I found to be vulnerable to XSS. Speaker names, talk titles, event names, theme names and a few others all have areas where they were output unescaped. The ones included in the patch were all verified by testing and debugging but it is not guaranteed to be a comprehensive fix.