diff options
| author | Thomas Bruederli <thomas@roundcube.net> | 2012-10-04 16:59:37 +0200 |
|---|---|---|
| committer | Thomas Bruederli <thomas@roundcube.net> | 2012-10-04 17:02:14 +0200 |
| commit | 0ce66babed66c84cb8361e67b171fa65c1bab01a (patch) | |
| tree | 0a5f58180c8890d0140193c3d0c6cfd646b196af | |
| parent | ef7a786b38d36374585be6b5800ce1862b40eb50 (diff) | |
Fix HTTP User-Agent XSS vulnerability (#1488737)
| -rw-r--r-- | program/steps/utils/error.inc | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/program/steps/utils/error.inc b/program/steps/utils/error.inc index 81adc2b4e..13440600c 100644 --- a/program/steps/utils/error.inc +++ b/program/steps/utils/error.inc @@ -5,7 +5,7 @@ | program/steps/utils/error.inc | | | | This file is part of the Roundcube Webmail client | - | Copyright (C) 2005-2011, The Roundcube Dev Team | + | Copyright (C) 2005-2012, The Roundcube Dev Team | | | | Licensed under the GNU General Public License version 3 or | | any later version with exceptions for skins & plugins. | @@ -25,11 +25,11 @@ // browser is not compatible with this application if ($ERROR_CODE==409) { - $user_agent = $_SERVER['HTTP_USER_AGENT']; + $user_agent = htmlentities($_SERVER['HTTP_USER_AGENT']); $__error_title = 'Your browser does not suit the requirements for this application'; $__error_text = <<<EOF <i>Supported browsers:</i><br /> -» Microsoft Internet Explorer 6+<br /> +» Microsoft Internet Explorer 7+<br /> » Mozilla Firefox 3+<br /> » Chrome 10+<br /> » Safari 4+<br /> |