X-Git-Url: https://jfr.im/git/irc/unrealircd/unrealircd-webpanel.git/blobdiff_plain/630261974fd350964443aed92704938d4a8bd858..67bff06aa6fd4d7d3a9aefc2919307326fa6d755:/api/server-bans.php

diff --git a/api/server-bans.php b/api/server-bans.php
index d109dd6..225511f 100644
--- a/api/server-bans.php
+++ b/api/server-bans.php
@@ -1,24 +1,29 @@
 <?php
-
 define('NO_EVENT_STREAM_HEADER',1);
 require_once('common_api.php');
 header("Content-type: application/json; charset=utf-8");
+
+if (!$rpc)
+    die(json_encode([]));
+
+
 $tkls = $rpc->serverban()->getAll();
 
 $out = [];
 foreach($tkls as $tkl)
 {
     $set_in_config = ((isset($tkl->set_in_config) && $tkl->set_in_config) || ($tkl->set_by == "-config-")) ? true : false;
-    $set_by = $set_in_config ? "<span class=\"badge rounded-pill badge-secondary\">Config</span>" : show_nick_only($tkl->set_by);
+    $set_by = $set_in_config ? "<span class=\"badge rounded-pill badge-secondary\">Config</span>" : show_nick_only(htmlspecialchars($tkl->set_by));
     $select = '';
     if (!$set_in_config)
         $select = "<input type=\"checkbox\" value='" . base64_encode($tkl->name).",".base64_encode($tkl->type) . "' name=\"tklch[]\">";
+
     $out[] = [
         "Select" => $select,
-        "Mask" => $tkl->name,
+        "Mask" => htmlspecialchars($tkl->name),
         "Type" => $tkl->type_string,
         "Duration" => $tkl->duration_string,
-        "Reason" => $tkl->reason,
+        "Reason" => htmlspecialchars($tkl->reason),
         "Set By" => $set_by,
         "Set On" => $tkl->set_at_string,
         "Expires" => $tkl->expire_at_string,