B #5502: Script injection in SPICE viewer (#546)

2025-03-21 14:50:08 +03:00 · 2017-10-26 11:09:37 +02:00 · 2017-10-26 11:09:37 +02:00 · 7ca14d2d89
commit 7ca14d2d89
parent 1fd938e49e
1 changed files with 1 additions and 0 deletions
--- a/src/sunstone/sunstone-server.rb
+++ b/src/sunstone/sunstone-server.rb
@ -523,6 +523,7 @@ get '/spice' do
    if !authorized?
        erb :login
    else
+        params[:title] = CGI::escape(params[:title])
        erb :spice
    end
 end