Merge pull request #381 from atsampson/escapestatus

Escape server and user names in the status HTML
This commit is contained in:
Volker Fischer 2020-06-20 21:29:15 +02:00 committed by GitHub
commit f25a20444b
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23

View file

@ -1590,7 +1590,7 @@ void CServer::WriteHTMLChannelList()
}
QTextStream streamFileOut ( &serverFileListFile );
streamFileOut << strServerNameWithPort << endl << "<ul>" << endl;
streamFileOut << strServerNameWithPort.toHtmlEscaped() << endl << "<ul>" << endl;
// depending on number of connected clients write list
if ( GetNumberOfConnectedClients() == 0 )
@ -1605,7 +1605,7 @@ void CServer::WriteHTMLChannelList()
{
if ( vecChannels[i].IsConnected() )
{
streamFileOut << " <li>" << vecChannels[i].GetName() << "</li>" << endl;
streamFileOut << " <li>" << vecChannels[i].GetName().toHtmlEscaped() << "</li>" << endl;
}
}
}