Bug 147486 - Fixes cross site scripting issues; first checked in on the 2.14.1…

Bug 147486 - Fixes cross site scripting issues; first checked in on the 2.14.1 branch, but I forgot the 2.16 branch/trunk (thanks bbaetz); patch=preed, r=bbaetz,myk

Bug 147486 - Fixes cross site scripting issues; first checked in on the 2.14.1…
d2895af6 · preed%sigkill.com · bd9136c7 · d2895af6
Commit d2895af6 authored Jun 01, 2002 by preed%sigkill.com
Show whitespace changes
Inline Side-by-side

Showing with 2 additions and 2 deletions

editusers.cgi editusers.cgi +2 -2

No files found.
--- a/editusers.cgi
+++ b/editusers.cgi
@@ -343,7 +343,7 @@ if ($action eq 'list') {
            $s = "<STRIKE>";
            $e = "</STRIKE>";
        }
-        $realname ||= "<FONT COLOR=\"red\">missing</FONT>";
+        $realname = ($realname ? html_quote($realname) : "<FONT COLOR=\"red\">missing</FONT>");
        print "<TR>\n";
        print "  <TD VALIGN=\"top\"><A HREF=\"editusers.cgi?action=edit&user=", url_quote($user), "\"><B>$s$user$e</B></A></TD>\n";
        print "  <TD VALIGN=\"top\">$s$realname$e</TD>\n";
@@ -542,7 +542,7 @@ if ($action eq 'del') {
             WHERE login_name=" . SqlQuote($user));
    my ($realname, $groupset) = 
      FetchSQLData();
-    $realname ||= "<FONT COLOR=\"red\">missing</FONT>";
+    $realname = ($realname ? html_quote($realname) : "<FONT COLOR=\"red\">missing</FONT>");
    
    print "<TABLE BORDER=1 CELLPADDING=4 CELLSPACING=0>\n";
    print "<TR BGCOLOR=\"#6666FF\">\n";