PirateBox-Dev/PirateBoxScripts_Webserver — pull request #78 by Liblor (2014-10-09 16:50:53+00:00)
Title: [fix] XSS in forest.py

Hey :)

The subject string in forest.py hasn't been escaped, which led to a persistent xss vulnerability. This should fix it :smiley:

Oh and at the moment the name, subject and "body" are escaped before storing. I think it's better not to store it escaped, but rather display it escaped. Storing it escaped makes it harder to search through the forum posts.
Well, it isn't a big problem, but what do you think?