Please fix the guestbook XSS
**Stored XSS**
Normal users can store an XSS payload in rich-text content, confirmed in news comments and likely guestbook
Example impact: attacker posts an image payload in a comment; when another user/admin hovers or opens the rendered image, JavaScript runs in their browser.
**Arbitrary Upload Delete**
Example impact: attacker guesses existing shared file IDs, creates a news comment referencing them, then deletes their own comment; the CMS deletes files that may belong to other users/content.
Fixed. Thanks 🤠

