[FIX] - admin/email.php

[thunderstrike]

Detail: Check for subject and message chars.

Find:

$subject = stripslashes(trim($HTTP_POST_VARS['subject']));
$message = stripslashes(trim($HTTP_POST_VARS['message']));

replace:

Code: [Select]

$subject = (isset($HTTP_POST_VARS['subject']) && preg_match("/[a-zA-Z0-9\.\,;:%&#@!\^-_~`\"'\[\]\{\}\*\/\?\(\)\n\r]/", $HTTP_POST_VARS['subject'])) ? stripslashes(trim($HTTP_POST_VARS['subject'])) : "";
$message = (isset($HTTP_POST_VARS['message']) && preg_match("/[a-zA-Z0-9\.\,;:%&#@!\^-_~`\"'\[\]\{\}\*\/\?\(\)\n\r]/", $HTTP_POST_VARS['message'])) ? stripslashes(trim($HTTP_POST_VARS['message'])) : "";