From: Christian Hofstaedtler <christian@hofstaedtler.name>
Date: Tue, 5 Aug 2014 08:44:38 +0000 (+0200)
Subject: webserver: htmlescape VERSION and config name
X-Git-Tag: auth-3.4.0-rc2~47^2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=a1caa8b82931793c4976aaff2a81b32b5d9e5248;p=pdns

webserver: htmlescape VERSION and config name

Those should not really have html characters in them, but let's be sure.
---

diff --git a/pdns/ws-auth.cc b/pdns/ws-auth.cc
index 68a2333cb..541a69fb8 100644
--- a/pdns/ws-auth.cc
+++ b/pdns/ws-auth.cc
@@ -224,9 +224,9 @@ void AuthWebServer::indexfunction(HttpRequest* req, HttpResponse* resp)
 
   ret<<"<div class=\"row\">"<<endl;
   ret<<"<div class=\"headl columns\">";
-  ret<<"<a href=\"/\" id=\"appname\">PowerDNS "VERSION;
+  ret<<"<a href=\"/\" id=\"appname\">PowerDNS "<<htmlescape(VERSION);
   if(!arg()["config-name"].empty()) {
-    ret<<" ["<<arg()["config-name"]<<"]";
+    ret<<" ["<<htmlescape(arg()["config-name"])<<"]";
   }
   ret<<"</a></div>"<<endl;
   ret<<"<div class=\"headr columns\"></div></div>";