From a1caa8b82931793c4976aaff2a81b32b5d9e5248 Mon Sep 17 00:00:00 2001
From: Christian Hofstaedtler <christian@hofstaedtler.name>
Date: Tue, 5 Aug 2014 10:44:38 +0200
Subject: [PATCH] webserver: htmlescape VERSION and config name

Those should not really have html characters in them, but let's be sure.
---
 pdns/ws-auth.cc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pdns/ws-auth.cc b/pdns/ws-auth.cc
index 68a2333cb..541a69fb8 100644
--- a/pdns/ws-auth.cc
+++ b/pdns/ws-auth.cc
@@ -224,9 +224,9 @@ void AuthWebServer::indexfunction(HttpRequest* req, HttpResponse* resp)
 
   ret<<"<div class=\"row\">"<<endl;
   ret<<"<div class=\"headl columns\">";
-  ret<<"<a href=\"/\" id=\"appname\">PowerDNS "VERSION;
+  ret<<"<a href=\"/\" id=\"appname\">PowerDNS "<<htmlescape(VERSION);
   if(!arg()["config-name"].empty()) {
-    ret<<" ["<<arg()["config-name"]<<"]";
+    ret<<" ["<<htmlescape(arg()["config-name"])<<"]";
   }
   ret<<"</a></div>"<<endl;
   ret<<"<div class=\"headr columns\"></div></div>";
-- 
2.40.0