From 83de10b7c2fb196c6f93a048e6ace489da2ff55b Mon Sep 17 00:00:00 2001 From: Jamie Cameron Date: Sat, 23 Dec 2023 08:42:59 -0800 Subject: [PATCH] Escape username in error --- cron/save_cron.cgi | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/cron/save_cron.cgi b/cron/save_cron.cgi index b5bfed6d9..63a3a0a7d 100755 --- a/cron/save_cron.cgi +++ b/cron/save_cron.cgi @@ -22,12 +22,12 @@ else { # Check if this user is allowed to execute cron jobs if (&supports_users()) { &can_use_cron($in{'user'}) || - &error(&text('save_eallow', $in{'user'})); + &error(&text('save_eallow', &html_escape($in{'user'}))); } # Check module access control &can_edit_user(\%access, $in{'user'}) || - &error(&text('save_ecannot', $in{'user'})); + &error(&text('save_ecannot', &html_escape($in{'user'}))); @files = &unique((map { $_->{'file'} } @jobs), "$config{'cron_dir'}/$in{'user'}"); @@ -42,7 +42,7 @@ if (&supports_users()) { &error($text{'save_euser'}); } if (!defined(getpwnam($in{'user'}))) { - &error(&text('save_euser2', $in{'user'})); + &error(&text('save_euser2', &html_escape($in{'user'}))); } } &parse_times_input($job, \%in);