diff options
| author | Roeland Jago Douma <rullzer@users.noreply.github.com> | 2020-03-09 11:03:40 +0300 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-03-09 11:03:40 +0300 |
| commit | ca926d418bb71c30f472652d3eecec8ff6fc98ef (patch) | |
| tree | dc02a2d022ec26793aad06f82401eb6780b30cd3 | |
| parent | c9566c322396887804c339445982eba448879dad (diff) | |
| parent | 8ab3e08d9be79d86d4f860d1fe1d5e3e073b675e (diff) | |
Merge pull request #19831 from nextcloud/backport/19815/stable17
[stable17] Prevent self-xss via invalid mysql user name on install screen
| -rw-r--r-- | core/templates/installation.php | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/core/templates/installation.php b/core/templates/installation.php index de9427a74d8..36f5f5bfc6d 100644 --- a/core/templates/installation.php +++ b/core/templates/installation.php @@ -15,10 +15,10 @@ script('core', [ <?php foreach($_['errors'] as $err): ?> <p> <?php if(is_array($err)):?> - <?php print_unescaped($err['error']); ?> - <span class='hint'><?php print_unescaped($err['hint']); ?></span> + <?php p($err['error']); ?> + <span class='hint'><?php p($err['hint']); ?></span> <?php else: ?> - <?php print_unescaped($err); ?> + <?php p($err); ?> <?php endif; ?> </p> <?php endforeach; ?> |