[xyd]

To be honest, I'm disappointed I have to post this here.

This mod is still vulnerable to allowing a user to pass non-sanitized HTML to the spy window.

I approached the author around 6-8 months ago and informed him of this, however it is clear that he did nothing about it - didn't fix it, didn't inform users that they were using vulnerable software. While I understand it is hard to admit that you made a mistake when coding, it is even more of a mistake to allow people to run software on their site which is vulnerable to XSS. Cross site scripting ruins companies and ruins lives.





For those of you who want to fix this yourselves, simply edit spy.php and find the following line:

$xml->add_tag('preview', $event['preview']);

...and change it to:

$xml->add_tag('preview', strip_tags($event['preview']));

Do the right thing and fix your software before someone gets hit.