Quick fix to allow only <a> and <br> in message data from getMessage to prevent XSS attacks.
Quick fix to allow only <a> and <br> in message data from getMessage to prevent XSS attacks.

The message is formatted on posting and it would probably be better to do encode htmlspecialchars there.


mrvanes/janus,mrvanes/janus,mrvanes/janus,mrvanes/janus