potential xss in drupalchat (6.x and likely 7.x)

Previously reported to the Drupal security team by Carlos Arnau Ros.

Dear,

This e-mail is for report security problems I found in the Drupalchat module.

- Drupal version and/or module version.

Drupal6 - Drupalchat 6.x dev version(probably the same security issue is present in all versions, also on D7)

- Problem:

Inside the drupalchat_init() function, an object is initialized($current_user) with some user related values directly from the BBDD. This values are recorded inside the table {drupalchat_users} with the function drupal_write_record(). Later, inside the _drupalchat_chat() function, the _drupalchat_buddylist_online() function is called, retrieving those values from the {drupalchat_users} table.

This module is not checking the integrity data, that should be passed through the check_plain() function, to prevent XSS attacks.

Also, in _drupalchat_chat() function, $value['name'] is passed to an array to be printed without any check. I think the best way could be use theme('username') here.

Don't hesitate to contact me for any doubts.

Regards,
Carlos