summaryrefslogtreecommitdiff
path: root/program
diff options
context:
space:
mode:
authorThomas Bruederli <thomas@roundcube.net>2012-10-04 16:59:37 +0200
committerThomas Bruederli <thomas@roundcube.net>2012-10-04 17:02:14 +0200
commit0ce66babed66c84cb8361e67b171fa65c1bab01a (patch)
tree0a5f58180c8890d0140193c3d0c6cfd646b196af /program
parentef7a786b38d36374585be6b5800ce1862b40eb50 (diff)
Fix HTTP User-Agent XSS vulnerability (#1488737)
Diffstat (limited to 'program')
-rw-r--r--program/steps/utils/error.inc6
1 files changed, 3 insertions, 3 deletions
diff --git a/program/steps/utils/error.inc b/program/steps/utils/error.inc
index 81adc2b4e..13440600c 100644
--- a/program/steps/utils/error.inc
+++ b/program/steps/utils/error.inc
@@ -5,7 +5,7 @@
| program/steps/utils/error.inc |
| |
| This file is part of the Roundcube Webmail client |
- | Copyright (C) 2005-2011, The Roundcube Dev Team |
+ | Copyright (C) 2005-2012, The Roundcube Dev Team |
| |
| Licensed under the GNU General Public License version 3 or |
| any later version with exceptions for skins & plugins. |
@@ -25,11 +25,11 @@
// browser is not compatible with this application
if ($ERROR_CODE==409) {
- $user_agent = $_SERVER['HTTP_USER_AGENT'];
+ $user_agent = htmlentities($_SERVER['HTTP_USER_AGENT']);
$__error_title = 'Your browser does not suit the requirements for this application';
$__error_text = <<<EOF
<i>Supported browsers:</i><br />
-&raquo; &nbsp;Microsoft Internet Explorer 6+<br />
+&raquo; &nbsp;Microsoft Internet Explorer 7+<br />
&raquo; &nbsp;Mozilla Firefox 3+<br />
&raquo; &nbsp;Chrome 10+<br />
&raquo; &nbsp;Safari 4+<br />