pkgsrc/sysutils/webmin/patches/patch-ao
tonnerre 4ca13adef1 Fix various cross site scripting, arbitrary command execution and various
other vulnerabilities in webmin (CVE-2008-0720).
2008-07-25 02:55:27 +00:00

14 lines
560 B
Text

$NetBSD: patch-ao,v 1.1 2008/07/25 02:55:27 tonnerre Exp $
--- postfix/mailq_search.cgi.orig 2007-09-21 23:26:52.000000000 +0200
+++ postfix/mailq_search.cgi
@@ -17,7 +17,8 @@ $neg = ($in{'field'} =~ s/^!//);
$neg ? !$r : $r } @qfiles;
print "<p><b>",&text($in{'field'} =~ /^\!/ ? 'search_results3' :
- 'search_results2', scalar(@qfiles), "<tt>$in{'match'}</tt>"),"</b><p>\n";
+ 'search_results2', scalar(@qfiles), "<tt>" .
+ &html_escape($in{'match'}) . "</tt>"),"</b><p>\n";
if (@qfiles) {
# Show matching messages
&mailq_table(\@qfiles);