From fd6bd8b686ff7a1d0abff10bbba9c4de45524316 Mon Sep 17 00:00:00 2001
From: Alex Grintsvayg <alex@grin.io>
Date: Thu, 9 Mar 2017 07:45:36 -0500
Subject: [PATCH] xss

---
 view/template/developer/_formCreditsPublish.php     | 4 ++--
 view/template/developer/_formNewDeveloperReward.php | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/view/template/developer/_formCreditsPublish.php b/view/template/developer/_formCreditsPublish.php
index 290ddd88..87d47874 100644
--- a/view/template/developer/_formCreditsPublish.php
+++ b/view/template/developer/_formCreditsPublish.php
@@ -8,7 +8,7 @@ lbry.quickstartForm('#form-new-publish-reward', "<?php echo $apiUrl ?>");
   <div class="form-row">
     <label for="wallet">Wallet Address</label>
     <div class="form-input">
-      <input type="text" name="wallet_address" value="<?php echo $defaultWalletAddress ?>"
+      <input type="text" name="wallet_address" value="<?php echo htmlspecialchars($defaultWalletAddress) ?>"
              class="required standard " placeholder="bYnFQUPTTDM1BYNCxgxKEav4FFQsrgDBoE">
     </div>
   </div>
@@ -25,4 +25,4 @@ lbry.quickstartForm('#form-new-publish-reward', "<?php echo $apiUrl ?>");
     <input type="hidden" name="access_token" value="<?php echo Session::get(Session::KEY_GITHUB_ACCESS_TOKEN) ?>" />
     <input type="submit" value="Send" class="btn-primary" data-submit-label="Send" data-submitting-label="Sending credits..." />
   </div>
-</form>
\ No newline at end of file
+</form>
diff --git a/view/template/developer/_formNewDeveloperReward.php b/view/template/developer/_formNewDeveloperReward.php
index 184e5a54..84d00c16 100644
--- a/view/template/developer/_formNewDeveloperReward.php
+++ b/view/template/developer/_formNewDeveloperReward.php
@@ -8,7 +8,7 @@
   <div class="form-row">
     <label for="wallet">Wallet Address</label>
     <div class="form-input">
-      <input type="text" name="wallet_address" value="<?php echo $defaultWalletAddress ?>"
+      <input type="text" name="wallet_address" value="<?php echo htmlspecialchars($defaultWalletAddress) ?>"
              class="required standard " placeholder="bYnFQUPTTDM1BYNCxgxKEav4FFQsrgDBoE">
     </div>
   </div>
@@ -20,4 +20,4 @@
   </div>
   <div class="meta">We require a GitHub account to prevent abuse. This will record your email (no spam) and mark you as interested in the lbry repo.
     No GitHub account? No problem! Join our <a href="https://slack.lbry.io" class="link-primary">Slack channel</a> and post an introduction in #tech.</div>
-</form>
\ No newline at end of file
+</form>