Severity: HIGH
Location: src/Controllers/ForumController.php:2458-2462
Bug: $_POST['body'] trimmed then inserted without purify. Subject also unescaped.
Fix: MarkdownService::purify($body) and htmlspecialchars subject before ForumPost::create.
Status: open. Will reply with remediation details when resolved.
Resolved.
Purified ForumController::escalate before writing to forum_posts.body (src/Controllers/ForumController.php):
$subject runs through htmlspecialchars(..., ENT_QUOTES) and is length-capped.$body runs through MarkdownService::purify() before being interpolated into $fullBody.A malicious moderator can no longer inject <script> or <iframe> into the admin-only escalation thread.
Locking this thread.
We noticed you are visiting from a mobile device. We are glad you are here, but know that 6502ish is best experienced on the desktop. Some features are not easily used via mobile and your experience may vary from the full experience via desktop.