From 329edd0988b694512e3929526982adcfafdba0e8 Mon Sep 17 00:00:00 2001
From: Jamie Cameron <jcameron@webmin.com>
Date: Sat, 9 May 2020 16:57:31 -0700
Subject: [PATCH] escape output

---
 cpan/download.cgi | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/cpan/download.cgi b/cpan/download.cgi
index d24ef4e93..8ae56c12f 100755
--- a/cpan/download.cgi
+++ b/cpan/download.cgi
@@ -219,7 +219,8 @@ foreach $pfile (@pfile) {
 	close(TAR);
 	if ($?) {
 		unlink(@pfile) if ($need_unlink);
-		&install_error(&text('download_etar', "<tt>$tar</tt>"));
+		&install_error(&text('download_etar',
+			"<tt>".&html_escape($tar)."</tt>"));
 		}
 	}
 if (@dirs == 0 || $file{'Makefile.PL'}+$file{'Build.PL'} < @dirs) {