From 5a26bc4fdbf3934528325253b2e1dee0cc1898e9 Mon Sep 17 00:00:00 2001
From: "Cathy J. Fitzpatrick" <cathy@cathyjf.com>
Date: Wed, 30 Jan 2013 22:49:51 -0700
Subject: [PATCH] Fix XSS in getassertion

---
 action.php | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/action.php b/action.php
index da3304dd1..917fa417e 100644
--- a/action.php
+++ b/action.php
@@ -107,6 +107,7 @@ foreach ($reqs as $reqData) {
 		break;
 	case 'checklogin':
 		// direct
+		header('Content-type: text/plain');
 		die(!!$users->getUser($reqData['userid']));
 		break;
 	case 'logout':
@@ -125,6 +126,7 @@ foreach ($reqs as $reqData) {
 		break;
 	case 'getsessiontoken':
 		// direct
+		header('Content-type: text/plain');
 		die($users->getSessionToken($reqData['servertoken']));
 		break;
 	case 'getassertion':
@@ -132,6 +134,7 @@ foreach ($reqs as $reqData) {
 		if (empty($reqData['servertoken'])) {
 			die('Probably cached version of client.');
 		}
+		header('Content-type: text/plain');
 		die($users->getAssertion(@$reqData['userid'], $reqData['servertoken']));
 		break;
 	case 'verifysessiontoken':