From 87ddd4cbc7e3f08575e11a51e79614e38fdc90d0 Mon Sep 17 00:00:00 2001
From: Rory M <roddux@gmail.com>
Date: Fri, 22 Apr 2016 12:34:41 +0100
Subject: [PATCH 1/4] Fix for XSS bug

Pointed at the correct branch this time.
---
 api.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/api.php b/api.php
index ea74ca5f..b77d89a6 100644
--- a/api.php
+++ b/api.php
@@ -48,5 +48,5 @@
     }
 
 
-    echo json_encode($data);
+    echo htmlspecialchars(json_encode($data));
 ?>

From 66e0c0f66e02ca01e338fcd0b20e4ce132cbf682 Mon Sep 17 00:00:00 2001
From: Rory M <roddux@gmail.com>
Date: Fri, 22 Apr 2016 13:12:10 +0100
Subject: [PATCH 2/4] Fixed incorrect ordering of sanitisers

`json_encode` needs to call the result of `htmlspecialchars`, not visa versa!
---
 api.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/api.php b/api.php
index b77d89a6..e9bdf0f7 100644
--- a/api.php
+++ b/api.php
@@ -48,5 +48,5 @@
     }
 
 
-    echo htmlspecialchars(json_encode($data));
+    echo json_encode(htmlspecialchars($data));
 ?>

From b91b7cacb019f0a923ddcb9a012b81dac3abf1a4 Mon Sep 17 00:00:00 2001
From: Rory M <roddux@gmail.com>
Date: Fri, 22 Apr 2016 13:21:53 +0100
Subject: [PATCH 3/4] Final fix for XSS patch

`htmlspecialchars` does not work on arrays.
This is why testing is important :^)
---
 api.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/api.php b/api.php
index e9bdf0f7..f8a590cf 100644
--- a/api.php
+++ b/api.php
@@ -47,6 +47,6 @@
         $data = array_merge($data, getAllQueries());
     }
 
-
-    echo json_encode(htmlspecialchars($data));
+    foreach ($data as &$d) $d = htmlspecialchars($d);
+    echo json_encode($data);
 ?>

From 26d54cfa9bdc15b8718fee586602a861307486de Mon Sep 17 00:00:00 2001
From: Rory M <roddux@gmail.com>
Date: Fri, 22 Apr 2016 14:27:21 +0100
Subject: [PATCH 4/4] Fix for XSS bug

I actually tested this one! it works.
My apologies for the previous, non-working commits-- I had to refresh my knowledge of PHP.
---
 api.php | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/api.php b/api.php
index f8a590cf..85b282ea 100644
--- a/api.php
+++ b/api.php
@@ -47,6 +47,18 @@
         $data = array_merge($data, getAllQueries());
     }
 
-    foreach ($data as &$d) $d = htmlspecialchars($d);
+    function filterArray(&$a) {
+	    $sanArray = array();
+	    foreach ($a as $k=>$v) {
+	        if (is_array($v)) {
+	            $sanArray[htmlspecialchars($k)] = filterArray($v);
+            } else {
+	            $sanArray[htmlspecialchars($k)] = htmlspecialchars($v);
+            }
+	    }
+	    return $sanArray;
+    }
+    
+    $data = filterArray($data);
     echo json_encode($data);
 ?>