diff --git a/bibtexbrowser.php b/bibtexbrowser.php index e4a1e95..2110055 100755 --- a/bibtexbrowser.php +++ b/bibtexbrowser.php @@ -243,10 +243,11 @@ function _zetDB($bibtex_filenames) { $ext = pathinfo($bib, PATHINFO_EXTENSION); // this is a security protection if (BIBTEXBROWSER_LOCAL_BIB_ONLY && (!file_exists($bib) || strcasecmp($ext, 'bib') != 0)) { - - // to automate dectection of faulty links with tools such as webcheck - header('HTTP/1.1 404 Not found'); - die('the bib file '.$bib.' does not exist !'); + // to automate dectection of faulty links with tools such as webcheck + header('HTTP/1.1 404 Not found'); + // escape $bib to prevent XSS + $escapedBib = htmlEntities($bib, ENT_QUOTES); + die('the bib file '.$escapedBib.' does not exist !'); } } // end for each