X-Git-Url: https://jfr.im/git/irc/unrealircd/unrealircd-webpanel.git/blobdiff_plain/582e5c7479087f37c2002d3e3d1dfe73e6db0381..2421056f724a011ee38a0249edb2802d4c7bd925:/api/server-bans.php

diff --git a/api/server-bans.php b/api/server-bans.php
index d109dd6..baff47e 100644
--- a/api/server-bans.php
+++ b/api/server-bans.php
@@ -9,16 +9,17 @@ $out = [];
 foreach($tkls as $tkl)
 {
     $set_in_config = ((isset($tkl->set_in_config) && $tkl->set_in_config) || ($tkl->set_by == "-config-")) ? true : false;
-    $set_by = $set_in_config ? "<span class=\"badge rounded-pill badge-secondary\">Config</span>" : show_nick_only($tkl->set_by);
+    $set_by = $set_in_config ? "<span class=\"badge rounded-pill badge-secondary\">Config</span>" : show_nick_only(htmlspecialchars($tkl->set_by));
     $select = '';
     if (!$set_in_config)
         $select = "<input type=\"checkbox\" value='" . base64_encode($tkl->name).",".base64_encode($tkl->type) . "' name=\"tklch[]\">";
+
     $out[] = [
         "Select" => $select,
-        "Mask" => $tkl->name,
+        "Mask" => htmlspecialchars($tkl->name),
         "Type" => $tkl->type_string,
         "Duration" => $tkl->duration_string,
-        "Reason" => $tkl->reason,
+        "Reason" => htmlspecialchars($tkl->reason),
         "Set By" => $set_by,
         "Set On" => $tkl->set_at_string,
         "Expires" => $tkl->expire_at_string,