From 0a625ae8ff737f471ee4e29853ba57db20352b1a Mon Sep 17 00:00:00 2001
From: Lukas Fleischer <archlinux@cryptocrack.de>
Date: Wed, 30 Mar 2011 17:07:27 +0200
Subject: Fix XSS vulnerability in "web/template/header.php".

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
---
 web/template/header.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'web/template')

diff --git a/web/template/header.php b/web/template/header.php
index 4939b57..0f0e362 100644
--- a/web/template/header.php
+++ b/web/template/header.php
@@ -51,8 +51,8 @@
 reset($SUPPORTED_LANGS);
 foreach ($SUPPORTED_LANGS as $lang => $lang_name) {
         print '<a href="'
-                . $_SERVER["PHP_SELF"]."?setlang=$lang\""
-		. " title=\"$lang_name\">"
+		. htmlspecialchars($_SERVER["PHP_SELF"], ENT_QUOTES)
+		."?setlang=$lang\" title=\"$lang_name\">"
 		. strtolower($lang) . "</a>\n";
 }
 ?>
-- 
cgit v1.2.3-54-g00ecf