captive: Fix potential authenticated XSS in title processing

[ipfire-2.x.git] / html / cgi-bin / captive.cgi

diff --git a/html/cgi-bin/captive.cgi b/html/cgi-bin/captive.cgi
index f3bb28cb2274f0d8e30c0c5be9c3d95472527715..b7c42e797e4fb6964f3755679da8287716123740 100755 (executable)
--- a/html/cgi-bin/captive.cgi
+++ b/html/cgi-bin/captive.cgi
@@ -104,7 +104,7 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'save'}) {
        $settings{'ENABLE_GREEN'}               = $cgiparams{'ENABLE_GREEN'};
        $settings{'ENABLE_BLUE'}                = $cgiparams{'ENABLE_BLUE'};
        $settings{'AUTH'}                               = $cgiparams{'AUTH'};
-       $settings{'TITLE'}                              = $cgiparams{'TITLE'};
+       $settings{'TITLE'}                      = &Header::escape($cgiparams{'TITLE'});
        $settings{'COLOR'}                      = $cgiparams{'COLOR'};
        $settings{'SESSION_TIME'}               = $cgiparams{'SESSION_TIME'};
 
@@ -237,7 +237,7 @@ if ($cgiparams{'ACTION'} eq 'delete-client') {
 }
 
 #open webpage, print header and open box
-&Header::openpage($Lang::tr{'Captive menu'}, 1, '');
+&Header::openpage($Lang::tr{'Captive'}, 1, '');
 &Header::openbigbox();
 
 # If an error message exists, show a box with the error message