X-Git-Url: http://git.harvie.cz/?a=blobdiff_plain;f=wwwroot%2Finc%2Feventz%2Fbanlist.inc;h=8f14448b3f372f1613fff245f7d489f98aa2ba90;hb=8f03b4aca1ae066a7fb03e4f5204682932091e08;hp=d817840602ddba28b6674bfb6a0c1646643e40f2;hpb=fd15ea3a496d31453e21ac89ff4be0ae3fe671ef;p=mirrors%2FKyberia-bloodline.git

diff --git a/wwwroot/inc/eventz/banlist.inc b/wwwroot/inc/eventz/banlist.inc
index d817840..8f14448 100644
--- a/wwwroot/inc/eventz/banlist.inc
+++ b/wwwroot/inc/eventz/banlist.inc
@@ -8,7 +8,8 @@ if ($node['node_permission']!=('owner' || 'master' || 'op')) {
 $error=$error_messages['EVENT_PERMISSION_ERROR'];
 return false;
 }
-		$bans=explode(";",$_POST['bans']);
+		$bans = explode(";",$_POST['bans']); // XXX sqli?
+		$bans = array_map('db_escape_string', $bans); 
 
 		$db->query("update node_access set node_permission='' where node_id=$node_id and node_permission='ban'");
 		foreach ($bans as $ban) {