From 2edde580b41d296b8b67745f578a8132d648900b Mon Sep 17 00:00:00 2001
From: Jaap Marcus <9754650+jaapmarcus@users.noreply.github.com>
Date: Thu, 9 Sep 2021 10:46:06 +0200
Subject: [PATCH] Add htmlentities to prevent xss

---
 web/templates/pages/list_key.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/web/templates/pages/list_key.html b/web/templates/pages/list_key.html
index a4f48d8b28..e6c6545321 100644
--- a/web/templates/pages/list_key.html
+++ b/web/templates/pages/list_key.html
@@ -42,7 +42,7 @@
 								<a id="delete_link_<?=$i?>" class="data-controls do_delete" title="<?=_('delete');?>">
 									<i class="fas fa-trash status-icon red status-icon dim do_delete"></i>
 									<?php if (($_SESSION['userContext'] === 'admin') && (isset($_GET['user'])) && ($_GET['user'] !== 'admin')) { ?>
-										<input type="hidden" name="delete_url" value="/delete/key/?user=<?=$_GET['user']?>&key=<?=$key?>&token=<?=$_SESSION['token']?>" />
+										<input type="hidden" name="delete_url" value="/delete/key/?user=<?=htmlentities($_GET['user']);?>&key=<?=$key?>&token=<?=$_SESSION['token']?>" />
 									<?php } else { ?>
 										<input type="hidden" name="delete_url" value="/delete/key/?key=<?=$key?>&token=<?=$_SESSION['token']?>" />
 									<?php } ?>