From abe49a77fa9687987200c25749822625513ff3dc Mon Sep 17 00:00:00 2001
From: Myron Blair <myronblair@outlook.com>
Date: Mon, 6 Jul 2026 07:52:39 +0000
Subject: [PATCH] Fix stored XSS in admin gamer overview (unescaped
 username/alias/email) and undefined-variable logging bug in purchase.php

---
 admin/index.php  | 6 +++---
 api/purchase.php | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/admin/index.php b/admin/index.php
index e6999ae..763a588 100644
--- a/admin/index.php
+++ b/admin/index.php
@@ -1636,9 +1636,9 @@ function renderGamerOverview(u, stats) {
   const verified = parseInt(u.email_verified);
   document.getElementById('gm-info-grid').innerHTML = [
     { label: 'User ID',       val: '#' + u.id },
-    { label: 'Username',      val: u.username },
-    { label: 'Alias',         val: u.alias },
-    { label: 'Email',         val: u.email || '—' },
+    { label: 'Username',      val: escHtmlA(u.username) },
+    { label: 'Alias',         val: escHtmlA(u.alias) },
+    { label: 'Email',         val: u.email ? escHtmlA(u.email) : '—' },
     { label: 'Status',        val: `<span class="badge b-${u.status}">${u.status}</span>` },
     { label: 'Email Verified',val: verified ? '<span style="color:var(--green)">✓ Yes</span>' : '<span style="color:var(--yellow)">⚠ No</span>' },
     { label: 'Token Balance',  val: `<span style="color:var(--gold);font-family:\'Exo 2\',sans-serif;font-weight:700">${parseFloat(u.tokens||0)} 🪙</span>` },
diff --git a/api/purchase.php b/api/purchase.php
index 8ae4b39..f3accf3 100644
--- a/api/purchase.php
+++ b/api/purchase.php
@@ -66,7 +66,7 @@ if ($isManual) {
         $playerName, $cardholderName, $billingEmail, $isCustom ? 1 : 0
     ]);
     $pid = db()->lastInsertId();
-    logActivity('manual_payment_pending', $userId, null, 'purchase', 0, "Manual payment pending: {$paymentMethod} \${$amountDollars}");
+    logActivity('manual_payment_pending', $userId, null, 'purchase', 0, "Manual payment pending: {$method} \$" . number_format($priceCents / 100, 2));
 echo json_encode(['success'=>true,'manual'=>true,'purchase_id'=>$pid,
         'message'=>"Request #{$pid} submitted! Tokens credited after payment verification."]);
     exit;
@@ -150,7 +150,7 @@ $bal = db()->prepare("SELECT tokens FROM users WHERE id=?");
 $bal->execute([$userId]);
 $newBal = (float)$bal->fetchColumn();
 logActivity('token_purchase', $userId, null, 'purchase', (int)db()->lastInsertId(),
-    "Bought {$tokens} tokens via {$paymentMethod} for \${$amountDollars}");
+    "Bought {$tokens} tokens via {$method} for \$" . number_format($priceCents / 100, 2));
 echo json_encode([
     'success'      => true,
     'manual'       => false,