From b661b5d16334c25ab49b6347472d0f8ffc51112f Mon Sep 17 00:00:00 2001
From: Jamie Cameron <jcameron@webmin.com>
Date: Sun, 18 Oct 2026 11:03:07 -0700
Subject: [PATCH] Escape param included in header

---
 lpadmin/list_jobs.cgi | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lpadmin/list_jobs.cgi b/lpadmin/list_jobs.cgi
index e63eff308..b9a7b92a4 100755
--- a/lpadmin/list_jobs.cgi
+++ b/lpadmin/list_jobs.cgi
@@ -6,7 +6,8 @@ require './lpadmin-lib.pl';
 &ReadParse();
 print "Refresh: $config{'queue_refresh'}\r\n"
 	if ($config{'queue_refresh'});
-&ui_print_header(&text('jobs_on', "<tt>$in{'name'}</tt>"), $text{'jobs_title'}, "");
+&ui_print_header(&text('jobs_on', "<tt>".&html_escape($in{'name'})."</tt>"),
+		 $text{'jobs_title'}, "");
 
 @jobs = &get_jobs($in{'name'});
 if (@jobs) {