Sanitize HTML output from the 'showuser' command

diff --git a/webcit/userlist.c b/webcit/userlist.c
index e74ab2305150772e1dda831f291b98b571398857..38539c0e1a6ed5b11b51f574fa487831a3d7e02d 100644 (file)
--- a/webcit/userlist.c
+++ b/webcit/userlist.c
@@ -151,7 +151,9 @@ void showuser(void)
                urlescputs(who);
                wprintf("\">");
        }
-       wprintf("</td><td><h1>%s</h1></td></tr></table></center>\n", who);
+       wprintf("</td><td><h1>");
+       escputs(who);
+       wprintf("</h1></td></tr></table></center>\n");
        serv_printf("RBIO %s", who);
        serv_getln(buf, sizeof buf);
        if (buf[0] == '1') {