From 9da2ff6f9f8a422b17b45e4ec2eb4cd26c5669e9 Mon Sep 17 00:00:00 2001
From: Philip Häusler <msquare@notrademark.de>
Date: Fri, 27 Dec 2013 19:45:50 +0100
Subject: #137 fixed xss on login

---
 includes/model/User_model.php | 8 ++++++++
 1 file changed, 8 insertions(+)

(limited to 'includes/model/User_model.php')

diff --git a/includes/model/User_model.php b/includes/model/User_model.php
index 523685df..a69c288c 100644
--- a/includes/model/User_model.php
+++ b/includes/model/User_model.php
@@ -1,5 +1,13 @@
 <?php
 
+/**
+ * Strip unwanted characters from a users nick.
+ * @param string $nick
+ */
+function User_validate_Nick($nick) {
+  return preg_replace("/([^a-z0-9üöäß. _+*-]{1,})/ui", '', $nick);
+}
+
 /**
  * Returns user by id.
  *
-- 
cgit v1.2.3-54-g00ecf