From 36e61250d7862449f8fdd8e169044de1a2c45658 Mon Sep 17 00:00:00 2001
From: daniel <daniel@daniel-DC1A-S>
Date: Sun, 20 May 2018 19:09:40 -0300
Subject: [PATCH 1/3] Avoid XSS on about tags

---
 view/channels.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/view/channels.php b/view/channels.php
index 3cd49665cb53..f6d8f4888f1f 100644
--- a/view/channels.php
+++ b/view/channels.php
@@ -40,7 +40,7 @@ class="img img-thumbnail img-responsive pull-left" style="max-height: 100px; mar
                                 <?php echo Subscribe::getButton($value['id']); ?> 
                             </span>
                             <div>
-                                <?php echo nl2br($value['about']); ?>
+                                <?php echo nl2br(htmlentities($value['about'])); ?>
                             </div>
                         </div>
                         <div class="clear clearfix">

From 3707a50a736608f46af774f4c06d28a984a56ff5 Mon Sep 17 00:00:00 2001
From: daniel <daniel@daniel-DC1A-S>
Date: Sun, 20 May 2018 19:20:16 -0300
Subject: [PATCH 2/3] Avoid XSS on about tags

---
 view/modeYoutube.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/view/modeYoutube.php b/view/modeYoutube.php
index c0583fbe0df1..18d32ef10dff 100644
--- a/view/modeYoutube.php
+++ b/view/modeYoutube.php
@@ -220,7 +220,7 @@
                                     <meta itemprop="contentURL" content="<?php echo Video::getLink($video['id'], $video['clean_title']); ?>" />
                                     <meta itemprop="embedURL" content="<?php echo Video::getLink($video['id'], $video['clean_title'], true); ?>" />
                                     <meta itemprop="uploadDate" content="<?php echo $video['created']; ?>" />
-                                    <meta itemprop="description" content="<?php echo str_replace('"', '', $video['title']); ?> - <?php echo $video['description']; ?>" />
+                                    <meta itemprop="description" content="<?php echo str_replace('"', '', $video['title']); ?> - <?php echo htmlentities($video['description']); ?>" />
                                 </div>
                                 <div class="col-xs-8 col-sm-8 col-md-8">
                                     <h1 itemprop="name">
@@ -571,7 +571,7 @@ function loadPlayLists() {
                                     <div class="col-xs-4 col-sm-2 col-lg-2 text-right"><strong><?php echo __("Category"); ?>:</strong></div>
                                     <div class="col-xs-8 col-sm-10 col-lg-10"><a class="btn btn-xs btn-default"  href="<?php echo $global['webSiteRootURL']; ?>cat/<?php echo $video['clean_category']; ?>"><span class="<?php echo $video['iconClass']; ?>"></span> <?php echo $video['category']; ?></a></div>
                                     <div class="col-xs-4 col-sm-2 col-lg-2 text-right"><strong><?php echo __("Description"); ?>:</strong></div>
-                                    <div class="col-xs-8 col-sm-10 col-lg-10" itemprop="description"><?php echo nl2br(textToLink($video['description'])); ?></div>
+                                    <div class="col-xs-8 col-sm-10 col-lg-10" itemprop="description"><?php echo nl2br(textToLink(htmlentities($video['description']))); ?></div>
                                 </div>
                             </div>
 

From cc93a6a9fd5ccbc36f0005701cf128d1ac0960d6 Mon Sep 17 00:00:00 2001
From: daniel <daniel@daniel-DC1A-S>
Date: Sun, 20 May 2018 19:21:51 -0300
Subject: [PATCH 3/3] Avoid XSS on about tags

---
 view/channel.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/view/channel.php b/view/channel.php
index 3a3f13204e19..b86be6a7909a 100644
--- a/view/channel.php
+++ b/view/channel.php
@@ -83,7 +83,7 @@
                     </span>
                 </div>
                 <div class="col-md-12">
-                    <?php echo nl2br($user->getAbout()); ?>
+                    <?php echo nl2br(htmlentities($user->getAbout())); ?>
                 </div>
                 <div class="col-md-12">
                     <div class="panel panel-default">