From dcfe3dceb70a26a61a11b9f8335c5f13548b2049 Mon Sep 17 00:00:00 2001
From: real_nowhereman <real_nowhereman@aa359531-4221-0410-9edc-b0b45c38dadb>
Date: Wed, 8 Jun 2011 18:20:35 +0000
Subject: [PATCH] fix XSS

---
 fp-interface/sharedtpls/comment-form.tpl | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/fp-interface/sharedtpls/comment-form.tpl b/fp-interface/sharedtpls/comment-form.tpl
index f55ac98..ff667f1 100644
--- a/fp-interface/sharedtpls/comment-form.tpl
+++ b/fp-interface/sharedtpls/comment-form.tpl
@@ -19,17 +19,17 @@
 	<div id="comment-userdata">
 	
 		<p>
-		<input type="text" {$error.name|notempty:'class="field-error"'} name="name" id="name" value="{$values.name|default:$cookie.name}" />
+		<input type="text" {$error.name|notempty:'class="field-error"'} name="name" id="name" value="{$values.name|wp_specialchars:1|default:$cookie.name}" />
 		<label class="textlabel" for="name">{$lang.comments.name}</label>
 		</p>
 		
 		<p>
-		<input type="text" {$error.email|notempty:'class="field-error"'} name="email" id="email" value="{$values.email|default:$cookie.email}" />
+		<input type="text" {$error.email|notempty:'class="field-error"'} name="email" id="email" value="{$values.email|wp_specialchars:1|default:$cookie.email}" />
 		<label class="textlabel" for="email">{$lang.comments.email}</label>
 		</p>
 		
 		<p>
-		<input type="text" {$error.url|notempty:'class="field-error"'} name="url" id="url" value="{$values.url|default:$cookie.url}" />
+		<input type="text" {$error.url|notempty:'class="field-error"'} name="url" id="url" value="{$values.url|wp_specialchars:1|default:$cookie.url}" />
 		<label class="textlabel" for="url">{$lang.comments.www}</label>
 		</p>