Security - Fix XSS attack vector in user profile - reported by Javier Bloem

main/auth/profile.php

@@ -143,6 +143,7 @@ if (api_get_setting('profile', 'name') !== 'true') {
 }
 $form->applyFilter(array('lastname', 'firstname'), 'stripslashes');
 $form->applyFilter(array('lastname', 'firstname'), 'trim');
+$form->applyFilter(array('lastname', 'firstname'), 'html_filter');
 $form->addRule('lastname' , get_lang('ThisFieldIsRequired'), 'required');
 $form->addRule('firstname', get_lang('ThisFieldIsRequired'), 'required');
 
@@ -165,6 +166,7 @@ if (CONFVAL_ASK_FOR_OFFICIAL_CODE) {
     }
     $form->applyFilter('official_code', 'stripslashes');
     $form->applyFilter('official_code', 'trim');
+    $form->applyFilter('official_code', 'html_filter');
     if (api_get_setting('registration', 'officialcode') == 'true' && api_get_setting('profile', 'officialcode') == 'true') {
         $form->addRule('official_code', get_lang('ThisFieldIsRequired'), 'required');
     }
@@ -202,6 +204,7 @@ if (api_get_setting('profile', 'phone') !== 'true') {
 }
 $form->applyFilter('phone', 'stripslashes');
 $form->applyFilter('phone', 'trim');
+$form->applyFilter('phone', 'html_filter');
 /*if (api_get_setting('registration', 'phone') == 'true') {
     $form->addRule('phone', get_lang('ThisFieldIsRequired'), 'required');
 }

main/inc/lib/usermanager.lib.php

@@ -4323,6 +4323,7 @@ class UserManager
                     $form->addElement('text', 'extra_'.$field_details[1], $field_details[3], array('size' => 40));
                     $form->applyFilter('extra_'.$field_details[1], 'stripslashes');
                     $form->applyFilter('extra_'.$field_details[1], 'trim');
+                    $form->applyFilter('extra_'.$field_details[1], 'html_filter');
 
                     if (!$admin_permissions) {
                         if ($field_details[7] == 0)