server ver

.gitignore

@@ -0,0 +1,11 @@
+node_modules/
+.env
+vendor/
+storage/
+public/b/
+public/thumbs/
+public/old/
+public/database/
+public/asbach/
+public/images/
+resources/views/unused/

app/Http/Controllers/UserController.php

@@ -126,7 +126,7 @@ class UserController extends Controller
             \Session::flash('info', 'Cannot register when logged in');
             return redirect('/');
         }
-        return view('apply');
+        return view('apply_open');
     }
 
         public function loggain()

app/Http/Controllers/VideoController.php

@@ -125,9 +125,9 @@ class VideoController extends Controller
             return new JsonResponse(['error' => 'erroneous_file_encoding']);
         }
         $video->videotitle = $request->get('videotitle', null);
-        $video->interpret = $request->get('interpret', null);
-        $video->songtitle = $request->get('songtitle', null);
-        $video->imgsource = $request->get('imgsource', null);
+        $video->interpret = htmlspecialchars($request->get('interpret', null));
+        $video->songtitle = htmlspecialchars($request->get('songtitle', null));
+        $video->imgsource = htmlspecialchars($request->get('imgsource', null));
         $video->user()->associate($user);
         $video->category()->associate(Category::findOrFail($request->get('category')));
         $video->hash = $hash;

app/Http/routes.php

@@ -130,7 +130,7 @@ Route::group(["middleware" => "theme"], function() {
 	Route::get('upload', 'VideoController@create')->middleware('auth');
 	Route::get('categories', 'CategoryController@index')->middleware('auth');
 	Route::get('webm', function() { return view('webm'); })->middleware('auth');
-    Route::get('settings', function() { return view('settings'); })->middleware('auth');
+    Route::get('settings', function() { return 404; })->middleware('auth');
     Route::get('matrix', function() { return view('matrix'); })->middleware('auth');
 	#Route::get('about', function() { return view('about'); })->middleware('auth');
     Route::get('about', 'aboutController@index')->middleware('auth');

app/Services/Markdown.php

@@ -258,6 +258,7 @@ class Markdown extends \Parsedown {
     protected function inlineUrl($Excerpt) {
         $e = parent::inlineUrl($Excerpt);
         if (is_null($e)) return;
+	$e['element']['attributes']['href'] = htmlspecialchars($e['element']['attributes']['href']);
         if (static::isImage($e['element']['attributes']['href'])) {
             $e['element']['name'] = 'img';
             $e['element']['attributes']['src'] = $e['element']['attributes']['href'];