[security] Self-XSS in setup (host parameter), see PMASA-2011-19

2011-12-13 12:42:39 -05:00
parent bd3735ba58
commit 0e707906e6
2 changed files with 2 additions and 1 deletions
--- a/libraries/config/ConfigFile.class.php
+++ b/libraries/config/ConfigFile.class.php
@@ -425,7 +425,7 @@ class ConfigFile
            return htmlspecialchars($verbose);
        }
        $host = $this->get("Servers/$id/host");
-        return empty($host) ? 'localhost' : $host;
+        return empty($host) ? 'localhost' : htmlspecialchars($host);
    }

    /**