Fix to address XSS issues #2

webmin · Aug 9, 2023 · 84b53e6 · 84b53e6
1 parent 03a1f39
commit 84b53e6
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/ssh/list_auths.cgi b/ssh/list_auths.cgi
@@ -17,7 +17,7 @@ if (@auths) {
 	foreach $a (@auths) {
 		print &ui_columns_row([ 
 			"<a href='edit_auth.cgi?idx=$a->{'index'}'>".
-			  "$a->{'name'}</a>",
+			  "@{[&html_escape($a->{'name'})]}</a>",
 			"<tt>".substr($a->{'key'}, 0, 40)." ... ".
 			      substr($a->{'key'}, -40)."</tt>",
 			]);

diff --git a/ssh/list_hosts.cgi b/ssh/list_hosts.cgi
@@ -11,7 +11,7 @@ foreach $h (@$hconf) {
 	if (lc($h->{'name'}) eq 'host') {
 		push(@links, "edit_host.cgi?idx=$i");
 		push(@icons, "images/host.gif");
-		push(@titles, $h->{'values'}->[0] eq '*' ? "<i>$text{'hosts_all'}</i>" : $h->{'values'}->[0]);
+		push(@titles, $h->{'values'}->[0] eq '*' ? "<i>$text{'hosts_all'}</i>" : &html_escape($h->{'values'}->[0]));
 		}
 	$i++;
 	}