Merci, I will happily look at it. Are there maybe other issues like this in the source code?

Maybe there are others, but I did not spotted them yet ;)

Maybe there are others, but I did not spotted them yet ;)

Would you mind to take a look or do you want to keep this one as-is?

https://github.com/search?q=repo%3Awebsvnphp%2Fwebsvn+type%3D%22hidden%22&type=code

I do not have any automated tool to test all websvn pages, but none of the other hidden input seems to have the same vulnerability :

• repname always correspond to an existing repo, or is not displayed
• path is corrected here
• some others already have their value escaped
• and the last remaining just have a fixed value (manualorder, op, ...) ;)

I do not have any automated tool to test all websvn pages, but none of the other hidden input seems to have the same vulnerability :

* `repname` always correspond to an existing repo, or is not displayed

* `path` is corrected here

* some others already have their value escaped

* and the last remaining just have a fixed value (manualorder, op, ...) ;)

I agree with you. Will try to merge later today.