sanitise categories, only allow numbers letters and spaces

Author: michield

public_html/lists/admin/configure.php

@@ -85,6 +85,14 @@
                     $value = str_replace('[DOMAIN]', '', $value);
                     $value = str_replace('[WEBSITE]', '', $value);
                 }
+                if ($id == 'list_categories') {
+                    $categories = explode(',',$value);
+                    $clean = array();
+                    foreach ($categories as $category) {
+                        $clean[] = preg_replace('/[^A-Z0-9\. ]+/i','',$category);
+                    }
+                    $value = implode(',',$clean);
+                }
                 if (empty($value) && !$info['allowempty']) {
                     //    Error($info['description']. ' ' . $GLOBALS['I18N']->get('cannot be empty'));
                     $haserror = $info['description'].' '.$GLOBALS['I18N']->get('cannot be empty');

public_html/lists/admin/list.php

@@ -177,7 +177,7 @@ function listMemberCounts($listId)
     }
     $tabs = new WebblerTabs();
     foreach ($aListCategories as $category) {
-        $category = trim($category);
+        $category = trim(htmlspecialchars($category));
         if ($category == '') {
             $category = s('Uncategorised');
         }