From c82b16df6496e8d77e12b7916493639352bae264 Mon Sep 17 00:00:00 2001
From: Stefan Ritt <stefan.ritt@psi.ch>
Date: Tue, 1 Mar 2011 07:35:51 +0000
Subject: [PATCH] Fixed XSS issue with mail0

SVN revision: 2391
---
 src/elogd.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/elogd.c b/src/elogd.c
index 051d608b..e91b38e7 100755
--- a/src/elogd.c
+++ b/src/elogd.c
@@ -23855,14 +23855,16 @@ void show_elog_entry(LOGBOOK * lbs, char *dec_path, char *command)
          rsprintf("<tr><td class=\"notifymsg\" colspan=2>%s</td></tr>\n",
                   loc("Email notification suppressed"));
       } else if (isparam("error")) {
-         rsprintf("<tr><td class=\"errormsg\" colspan=2>%s</td></tr>\n", getparam("error"));
+         strencode2(str, getparam("error"), sizeof(str));
+         rsprintf("<tr><td class=\"errormsg\" colspan=2>%s</td></tr>\n", str);
       } else {
          for (i = 0;; i++) {
             sprintf(str, "mail%d", i);
             if (isparam(str)) {
                if (i == 0)
                   rsprintf("<tr><td class=\"notifymsg\" colspan=2>");
-               rsprintf("%s <b>%s</b><br>\n", loc("Email sent to"), getparam(str));
+               strencode2(str, getparam(str), sizeof(str));
+               rsprintf("%s <b>%s</b><br>\n", loc("Email sent to"), str);
             } else
                break;
          }