Sanity!

html/ajax_dash.php

@@ -39,7 +39,7 @@ elseif (is_file('includes/common/'.$type.'.inc.php')) {
     $title             = ucfirst($type);
     $unique_id         = str_replace(array("-","."),"_",uniqid($type,true));
     $widget_id         = mres($_POST['id']);
-    $widget_settings   = json_decode(dbFetchCell('select settings from users_widgets where user_widget_id = ?',array($widget_id)),true);
+    $widget_settings   = json_decode(htmlspecialchars_decode(dbFetchCell('select settings from users_widgets where user_widget_id = ?',array($widget_id))),true);
     $widget_dimensions = $_POST['dimensions'];
     if( !empty($_POST['settings']) ) {
         define('show_settings',true);

html/includes/vars.inc.php

@@ -43,3 +43,5 @@ foreach ($_GET as $name => $value) {
 foreach ($_POST as $name => $value) {
     $vars[$name] = $value;
 }
+
+array_walk_recursive($vars,'sanitize_array');

html/index.php

@@ -214,14 +214,6 @@ else {
     <div class="col-md-12">
 <?php
 
-// To help debug the new URLs :)
-if (isset($devel) || isset($vars['devel'])) {
-    echo("<pre>");
-    print_r($_GET);
-    print_r($vars);
-    echo("</pre>");
-}
-
 if ($_SESSION['authenticated']) {
     // Authenticated. Print a page.
     if (isset($vars['page']) && !strstr("..", $vars['page']) &&  is_file("pages/" . $vars['page'] . ".inc.php")) {