From 76389ea06cd2d1980a798bd984414ae37ce49247 Mon Sep 17 00:00:00 2001
From: iliajie <ilia@webmin.dev>
Date: Thu, 3 Aug 2023 00:05:23 +0300
Subject: [PATCH] Fix to do more filtering to address reported XSS issue

---
 usermin/save_categories.cgi | 2 +-
 webmin/save_categories.cgi  | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/usermin/save_categories.cgi b/usermin/save_categories.cgi
index 7940ac899..d833593d1 100755
--- a/usermin/save_categories.cgi
+++ b/usermin/save_categories.cgi
@@ -16,7 +16,7 @@ foreach $t (keys %utext) {
 	if (!$in{$field."_def"}) {
 		$in{$field} ||
 			&error(&text('categories_edesc', $t ? $t : 'other'));
-		$catnames{$t} = $in{$field};
+		$catnames{$t} = &filter_javascript($in{$field});
 		}
 	}
 
diff --git a/webmin/save_categories.cgi b/webmin/save_categories.cgi
index 650d70492..25788c1b9 100755
--- a/webmin/save_categories.cgi
+++ b/webmin/save_categories.cgi
@@ -11,8 +11,8 @@ foreach $t (keys %text) {
 	$field = $t || "other";
 	if (!$in{$field."_def"}) {
 		$in{$field} || &error(&text('categories_edesc', $t || 'other'));
-		$catnames{$t} = $in{$field};
-		$catnames{'other'} = $in{$field} if ($t eq "");
+		$catnames{$t} = &filter_javascript($in{$field});
+		$catnames{'other'} = &filter_javascript($in{$field}) if ($t eq "");
 		}
 	}