[Web] Fix potential XSS in autodiscover-json.php

mailcow · Sep 7, 2021 · 8e736ba · 8e736ba
1 parent 80fc18c
commit 8e736ba
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/data/web/autodiscover-json.php b/data/web/autodiscover-json.php
@@ -16,6 +16,6 @@
 }
 else {
   http_response_code(400);
-  echo '{"ErrorCode":"InvalidProtocol","ErrorMessage":"The given protocol value \u0027' . $_GET['Protocol'] . '\u0027 is invalid. Supported values are \u0027ActiveSync,AutodiscoverV1\u0027"}';
+  echo '{"ErrorCode":"InvalidProtocol","ErrorMessage":"The given protocol value \u0027' . preg_replace("/[^\da-z]/i", '', $_GET['Protocol']) . '\u0027 is invalid. Supported values are \u0027ActiveSync,AutodiscoverV1\u0027"}';
 }
 ?>