[SECRUITY] Fix XSS vulnerability in API Callback

Author: MPOS123

include/classes/api.class.php

@@ -37,8 +37,10 @@ function get_json($data, $force=false) {
       )), $force ? JSON_FORCE_OBJECT : 0
     );
     // JSONP support issue #1700
-    if (isset($_REQUEST['callback']))
+    if (isset($_REQUEST['callback']) && ctype_alpha($_REQUEST['callback'])) {
+      header('Content-type: application/json; charset=utf-8');
       return $_REQUEST['callback'] . '(' . $json . ');';
+    }
     return $json;
   }