From 2476177ea7cfb7a14b92e5142502a6211a07a0f5 Mon Sep 17 00:00:00 2001
From: Jason Gochanour <jrgo@lanl.gov>
Date: Thu, 26 May 2016 11:40:25 -0600
Subject: [PATCH] Fixed XSS vulnerability with show_change_pwd_page and fixed
 an infinite loop in 'threaded' mode.

---
 src/elogd.c | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/src/elogd.c b/src/elogd.c
index 5ae6d3b2..47510756 100755
--- a/src/elogd.c
+++ b/src/elogd.c
@@ -9005,8 +9005,10 @@ void show_change_pwd_page(LOGBOOK * lbs)
    rsprintf("<table class=\"dlgframe\" cellspacing=0 align=center>");
 
    if (wrong_pwd == 1) {
-      if (error_str[0])
-         rsprintf("<tr><td colspan=2 class=\"dlgerror\">%s!</td></tr>\n", error_str);
+      if (error_str[0]) {
+         strencode2(str, error_str, sizeof(str));
+         rsprintf("<tr><td colspan=2 class=\"dlgerror\">%s!</td></tr>\n", str);
+      }
       else
          rsprintf("<tr><td colspan=2 class=\"dlgerror\">%s!</td></tr>\n", loc("Wrong password"));
    }
@@ -9015,8 +9017,10 @@ void show_change_pwd_page(LOGBOOK * lbs)
       rsprintf("<tr><td colspan=2 class=\"dlgerror\">%s!</td></tr>\n",
                loc("New passwords do not match, please retype"));
 
-   if (wrong_pwd == 3)
-      rsprintf("<tr><td colspan=2 class=\"dlgerror\">%s!</td></tr>\n", error_str);
+   if (wrong_pwd == 3) {
+      strencode2(str, error_str, sizeof(str));
+      rsprintf("<tr><td colspan=2 class=\"dlgerror\">%s!</td></tr>\n", str);
+   }
 
    rsprintf("<tr><td colspan=2 class=\"dlgtitle\">\n");
 
@@ -20733,7 +20737,8 @@ void show_elog_list(LOGBOOK * lbs, int past_n, int last_n, int page_n, BOOL defa
             if (i == *msg_list[index].lbs->n_el_index)
                break;
 
-            in_reply_to_id = msg_list[index].lbs->el_index[i].in_reply_to;
+            //in_reply_to_id = msg_list[index].lbs->el_index[i].in_reply_to;
+            in_reply_to_id = 0;
 
          } while (in_reply_to_id);
 
@@ -21102,8 +21107,9 @@ void show_elog_list(LOGBOOK * lbs, int past_n, int last_n, int page_n, BOOL defa
          rsprintf("<table width=\"100%%\" border=\"0\" cellpadding=\"0\" cellspacing=\"0\">\n");
 
          if (isparam("last")) {
-            rsprintf("<tr><td nowrap width=\"10%%\" class=\"attribname\">%s:</td>", loc("Restrict seach to last"));
-            rsprintf("<td class=\"attribvalue\">%s %s</td></tr>", getparam("last"), loc("days"));
+            rsprintf("<tr><td nowrap width=\"10%%\" class=\"attribname\">%s:</td>", loc("Restrict search to last"));
+            strencode2(str, getparam("last"), sizeof(str));
+            rsprintf("<td class=\"attribvalue\">%s %s</td></tr>", str, loc("days"));
          }
 
          if (isparam("ma") || isparam("ya") || isparam("da") || isparam("ha") || isparam("na")