Index: CHANGELOG
===================================================================
--- CHANGELOG	(revision 3646)
+++ CHANGELOG	(revision 3649)
@@ -4,4 +4,5 @@
 * 🛡 Security: New password management system (including silent migration)
 * 🛡 Security: Add Referrer-Policy header in admin pages
+* 🛡 Security: Fix potential XSS - thank's Trí Chim Trích for report
 * Dotclear news are now displayed in async way by js
 * Dotclear core update check is now done by async js - a forced check may still be done on <admin>/update.php page
Index: admin/auth.php
===================================================================
--- admin/auth.php	(revision 3627)
+++ admin/auth.php	(revision 3649)
@@ -83,5 +83,5 @@
 {
 	$user_id = !empty($_POST['user_id']) ? $_POST['user_id'] : null;
-	$user_email = !empty($_POST['user_email']) ? $_POST['user_email'] : '';
+	$user_email = !empty($_POST['user_email']) ? html::escapeHTML($_POST['user_email']) : '';
 	try
 	{
Index: admin/blogs.php
===================================================================
--- admin/blogs.php	(revision 3560)
+++ admin/blogs.php	(revision 3649)
@@ -54,5 +54,5 @@
 
 if (!empty($_GET['nb']) && (integer) $_GET['nb'] > 0) {
-	if ($nb_per_page != $_GET['nb']) {
+	if ($nb_per_page !=  (integer) $_GET['nb']) {
 		$show_filters = true;
 	}
Index: admin/comments.php
===================================================================
--- admin/comments.php	(revision 3560)
+++ admin/comments.php	(revision 3649)
@@ -78,5 +78,5 @@
 
 if (!empty($_GET['nb']) && (integer) $_GET['nb'] > 0) {
-	if ($nb_per_page != $_GET['nb']) {
+	if ($nb_per_page !=  (integer) $_GET['nb']) {
 		$show_filters = true;
 	}
Index: admin/posts.php
===================================================================
--- admin/posts.php	(revision 3560)
+++ admin/posts.php	(revision 3649)
@@ -179,5 +179,5 @@
 
 if (!empty($_GET['nb']) && (integer) $_GET['nb'] > 0) {
-	if ($nb_per_page != $_GET['nb']) {
+	if ($nb_per_page !=  (integer) $_GET['nb']) {
 		$show_filters = true;
 	}
Index: admin/user.php
===================================================================
--- admin/user.php	(revision 3639)
+++ admin/user.php	(revision 3649)
@@ -80,12 +80,12 @@
 		$cur->user_id = $_POST['user_id'];
 		$cur->user_super = $user_super = !empty($_POST['user_super']) ? 1 : 0;
-		$cur->user_name = $user_name = $_POST['user_name'];
-		$cur->user_firstname = $user_firstname = $_POST['user_firstname'];
-		$cur->user_displayname = $user_displayname = $_POST['user_displayname'];
-		$cur->user_email = $user_email = $_POST['user_email'];
-		$cur->user_url = $user_url = $_POST['user_url'];
-		$cur->user_lang = $user_lang = $_POST['user_lang'];
-		$cur->user_tz = $user_tz = $_POST['user_tz'];
-		$cur->user_post_status = $user_post_status = $_POST['user_post_status'];
+		$cur->user_name = $user_name = html::escapeHTML($_POST['user_name']);
+		$cur->user_firstname = $user_firstname = html::escapeHTML($_POST['user_firstname']);
+		$cur->user_displayname = $user_displayname = html::escapeHTML($_POST['user_displayname']);
+		$cur->user_email = $user_email = html::escapeHTML($_POST['user_email']);
+		$cur->user_url = $user_url = html::escapeHTML($_POST['user_url']);
+		$cur->user_lang = $user_lang = html::escapeHTML($_POST['user_lang']);
+		$cur->user_tz = $user_tz = html::escapeHTML($_POST['user_tz']);
+		$cur->user_post_status = $user_post_status = html::escapeHTML($_POST['user_post_status']);
 
 		if ($user_id && $cur->user_id == $core->auth->userID() && $core->auth->isSuperAdmin()) {
@@ -105,5 +105,5 @@
 		}
 
-		$user_options['post_format'] = $_POST['user_post_format'];
+		$user_options['post_format'] = html::escapeHTML($_POST['user_post_format']);
 		$user_options['edit_size'] = (integer) $_POST['user_edit_size'];
 
Index: admin/users.php
===================================================================
--- admin/users.php	(revision 3560)
+++ admin/users.php	(revision 3649)
@@ -52,8 +52,8 @@
 
 if (!empty($_GET['nb']) && (integer) $_GET['nb'] > 0) {
-	if ($nb_per_page != $_GET['nb']) {
+	if ($nb_per_page !=  (integer) $_GET['nb']) {
 		$show_filters = true;
 	}
-	$nb_per_page = $_GET['nb'];
+	$nb_per_page =  (integer) $_GET['nb'];
 }
 
