diff mbox series

[13/16] mail.cgi: Fixes bug 13891

Message ID 20250925111252.11893-13-adolf.belka@ipfire.org
State Staged
Commit 43b4ba3768db5e46b95c263accb5b26e90df8a08
Headers
Series [01/16] fwhosts.cgi Fix for bug 13876 & bug 13877 |

Commit Message

Adolf Belka 25 Sep 2025, 11:12 a.m. UTC 
Fixes: bug 13891 - mail.cgi txt_mailuser txt_mailpass Stored Cross-Site Scripting
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 html/cgi-bin/mail.cgi | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
diff mbox series

Patch

diff --git a/html/cgi-bin/mail.cgi b/html/cgi-bin/mail.cgi
index 0ed3dfeca..aae4abc31 100644
--- a/html/cgi-bin/mail.cgi
+++ b/html/cgi-bin/mail.cgi
@@ -2,7 +2,7 @@ 
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2020  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2025  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -102,8 +102,8 @@  if ($cgiparams{'ACTION'} eq "$Lang::tr{'save'}"){ #SaveButton on configsite
 		$mail{'RECIPIENT'}		= $cgiparams{'txt_recipient'};
 
 		if ($cgiparams{'txt_mailuser'} && $cgiparams{'txt_mailpass'}) {
-			$auth{'AUTHNAME'}		= $cgiparams{'txt_mailuser'};
-			$auth{'AUTHPASS'}		= $cgiparams{'txt_mailpass'};
+			$auth{'AUTHNAME'}		= &Header::escape($cgiparams{'txt_mailuser'});
+			$auth{'AUTHPASS'}		= &Header::escape($cgiparams{'txt_mailpass'});
 			$auth{'AUTHHOST'}		= $cgiparams{'txt_mailserver'};
 			print TXT1 "$auth{'AUTHNAME'}|$auth{'AUTHHOST'}:$auth{'AUTHPASS'}\n";
 		}