Bug 503980: show_bug.cgi doesn't properly escape <!-- inside bug summary - Patch...

diff --git a/Bugzilla/Template.pm b/Bugzilla/Template.pm
index c8ce711b83d4e0c739f6a56d42cad835f451c5c2..89d94c0245dd83d1fe6a9efb28de8c6c778c80c5 100644 (file)
--- a/Bugzilla/Template.pm
+++ b/Bugzilla/Template.pm
@@ -514,6 +514,7 @@ sub create {
                 $var =~ s/\n/\\n/g;
                 $var =~ s/\r/\\r/g;
                 $var =~ s/\@/\\x40/g; # anti-spam for email addresses
+                $var =~ s/</\\x3c/g;
                 return $var;
             },