From c9516f196271696af128b5f163a688f2d9c73931 Mon Sep 17 00:00:00 2001
From: Adam Sampson <ats@offog.org>
Date: Sat, 20 Jun 2020 16:43:18 +0100
Subject: [PATCH] Escape server and user names in the status HTML.

---
 src/server.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/server.cpp b/src/server.cpp
index 7fcae82e..efaeb650 100755
--- a/src/server.cpp
+++ b/src/server.cpp
@@ -1590,7 +1590,7 @@ void CServer::WriteHTMLChannelList()
     }
 
     QTextStream streamFileOut ( &serverFileListFile );
-    streamFileOut << strServerNameWithPort << endl << "<ul>" << endl;
+    streamFileOut << strServerNameWithPort.toHtmlEscaped() << endl << "<ul>" << endl;
 
     // depending on number of connected clients write list
     if ( GetNumberOfConnectedClients() == 0 )
@@ -1605,7 +1605,7 @@ void CServer::WriteHTMLChannelList()
         {
             if ( vecChannels[i].IsConnected() )
             {
-                streamFileOut << "  <li>" << vecChannels[i].GetName() << "</li>" << endl;
+                streamFileOut << "  <li>" << vecChannels[i].GetName().toHtmlEscaped() << "</li>" << endl;
             }
         }
     }