10 年之前 · 310f75a982
--- a/Sources/Load.php
+++ b/Sources/Load.php
@@ -1649,7 +1649,7 @@ function loadTheme($id_theme = 0, $initialize = true)
 
 	$context['forum_name'] = $mbname;
 
 	$context['forum_name_html_safe'] = $smcFunc['htmlspecialchars']($context['forum_name']);
 
 	$context['header_logo_url_html_safe'] = empty($settings['header_logo_url']) ? '' : $smcFunc['htmlspecialchars']($settings['header_logo_url']);
 
-	$context['current_action'] = isset($_REQUEST['action']) ? $_REQUEST['action'] : null;
 
+	$context['current_action'] = isset($_REQUEST['action']) ? $smcFunc['htmlspecialchars']($_REQUEST['action']) : null;
 
 	$context['current_subaction'] = isset($_REQUEST['sa']) ? $_REQUEST['sa'] : null;
 
 	$context['can_register'] = empty($modSettings['registration_method']) || $modSettings['registration_method'] != 3;
 
 	if (isset($modSettings['load_average']))
--- a/Sources/Subs.php
+++ b/Sources/Subs.php
@@ -2856,7 +2856,7 @@ function setupThemeContext($forceload = false)
 
 
 
 	$context['in_maintenance'] = !empty($maintenance);
 
 	$context['current_time'] = timeformat(time(), false);
 
-	$context['current_action'] = isset($_GET['action']) ? $_GET['action'] : '';
 
+	$context['current_action'] = isset($_GET['action']) ? $smcFunc['htmlspecialchars']($_GET['action']) : '';
 
 	$context['show_quick_login'] = !empty($modSettings['enableVBStyleLogin']) && $user_info['is_guest'];
 
 
 
 	// Get some news...
--- a/Themes/default/index.template.php
+++ b/Themes/default/index.template.php
@@ -167,8 +167,8 @@ function template_html_above()
 
 
 
 	echo '
 
 </head>
 
-<body id="', $context['browser_body_id'], '" class="action_', !empty($context['current_action']) ? htmlspecialchars($context['current_action']) : (!empty($context['current_board']) ?
 
-		'messageindex' : (!empty($context['current_topic']) ? 'display' : 'home')), !empty($context['current_board']) ? ' board_' . htmlspecialchars($context['current_board']) : '', '">';
 
+<body id="', $context['browser_body_id'], '" class="action_', !empty($context['current_action']) ? $context['current_action'] : (!empty($context['current_board']) ?
 
+		'messageindex' : (!empty($context['current_topic']) ? 'display' : 'home')), !empty($context['current_board']) ? ' board_' . $context['current_board'] : '', '">';
 
 }
 
 
 
 function template_body_above()