XSS security issue

[Caspar Leo]

Hey,

noticed a XSS vulnerability in users/edit_profile.php on line 45:

$newBio = $_POST['bio'];
Should be: $newBio = Input::get('bio');

Otherwise we got some naked & public scripts in users bios

[mudmin]

Yep! You are right. Thank you for this. I will get this on the todo list. THANK YOU!

[mudmin]

Actually, I double checked this. The problem with using Input::get there is that it would strip out all your formatting and punctuation. You'll noticed that the data is sanitized as it's displayed on the profile.php instead...
$usbio = html_entity_decode($thatUser->bio);

The XSS vulnerability should be taken care of by the token check done in the validation on line 41 unless you're seeing something I'm not.

I could definitely be missing something here. Let me know what you think.