From e5dcd02b627e0de85cd67a887365209805f6486d Mon Sep 17 00:00:00 2001
From: Matt Pass <matt@mattpass.com>
Date: Tue, 8 Mar 2016 15:41:58 +0000
Subject: [PATCH] xssClean unsanitised user input

---
 lib/get-branch.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/get-branch.php b/lib/get-branch.php
index 7f9ab94..e732f62 100644
--- a/lib/get-branch.php
+++ b/lib/get-branch.php
@@ -373,7 +373,7 @@ if (!isset($ftpSite) && $_SESSION['githubDiff']) {
 }
 ?>
 	<script>
-	targetElem = top.ICEcoder.filesFrame.contentWindow.document.getElementById('<?php echo $_GET['location'];?>');
+	targetElem = top.ICEcoder.filesFrame.contentWindow.document.getElementById('<?php echo xssClean($_GET['location'],"html");?>');
 	newUL = document.createElement("ul");
 	newUL.style = "display: block";
 	locNest = targetElem.parentNode.parentNode;