From: Michael Tremer <michael.tremer@ipfire.org>
Date: Thu, 25 Sep 2025 15:19:59 +0000 (+0200)
Subject: mail.cgi: Escape username/password in the right place
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=841d9dab524bfe6572471f4e14b97534e840bed1;p=ipfire-2.x.git

mail.cgi: Escape username/password in the right place

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
---

diff --git a/html/cgi-bin/mail.cgi b/html/cgi-bin/mail.cgi
index aae4abc31..6c024974d 100644
--- a/html/cgi-bin/mail.cgi
+++ b/html/cgi-bin/mail.cgi
@@ -102,8 +102,8 @@ if ($cgiparams{'ACTION'} eq "$Lang::tr{'save'}"){ #SaveButton on configsite
 		$mail{'RECIPIENT'}		= $cgiparams{'txt_recipient'};
 
 		if ($cgiparams{'txt_mailuser'} && $cgiparams{'txt_mailpass'}) {
-			$auth{'AUTHNAME'}		= &Header::escape($cgiparams{'txt_mailuser'});
-			$auth{'AUTHPASS'}		= &Header::escape($cgiparams{'txt_mailpass'});
+			$auth{'AUTHNAME'}		= $cgiparams{'txt_mailuser'};
+			$auth{'AUTHPASS'}		= $cgiparams{'txt_mailpass'};
 			$auth{'AUTHHOST'}		= $cgiparams{'txt_mailserver'};
 			print TXT1 "$auth{'AUTHNAME'}|$auth{'AUTHHOST'}:$auth{'AUTHPASS'}\n";
 		}
@@ -218,11 +218,13 @@ END
 		</tr>
 		<tr>
 			<td>$Lang::tr{'email mailuser'}</td>
-			<td><input type='text' name='txt_mailuser' value='$auth{'AUTHNAME'}' style='width:22em;'></td>
+			<td><input type='text' name='txt_mailuser'
+				value='@{[ &Header::escape($auth{'AUTHNAME'}) ]}' style='width:22em;'></td>
 		</tr>
 		<tr>
 			<td>$Lang::tr{'email mailpass'}</td>
-			<td><input type='password' name='txt_mailpass' value='$auth{'AUTHPASS'}' style='width:22em;' ></td>
+			<td><input type='password' name='txt_mailpass'
+				value='@{[ &Header::escape($auth{'AUTHPASS'}) ]}' style='width:22em;' ></td>
 		</tr>
 		<tr>
 			<td>$Lang::tr{'email tls'}</td>