From ba913ba0e77dd763889c0dee464cc8c4a73a708a Mon Sep 17 00:00:00 2001
From: Serghey Rodin <serghey.rodin@gmail.com>
Date: Fri, 19 Dec 2014 00:39:08 +0200
Subject: [PATCH] XSS security fix

---
 web/templates/admin/list_dns_rec.html | 2 +-
 web/templates/user/list_dns_rec.html  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/web/templates/admin/list_dns_rec.html b/web/templates/admin/list_dns_rec.html
index ec4326cc5..06b459a66 100644
--- a/web/templates/admin/list_dns_rec.html
+++ b/web/templates/admin/list_dns_rec.html
@@ -78,7 +78,7 @@
                                     <td class="log" width="239px"><b><?php echo $data[$key]['RECORD'] ?></b></td>
                                     <td class="log-counter-value" width="57px"><?php echo $data[$key]['TYPE'] ?></td>
                                     <td class="log-counter-value" width="62px"><?php echo $data[$key]['PRIORITY'] ?></td>
-                                    <td class="log-counter-value" ><?php echo $data[$key]['VALUE'] ?></td>
+                                    <td class="log-counter-value" ><?php echo htmlspecialchars($data[$key]['VALUE'], ENT_QUOTES, 'UTF-8') ?></td>
                                 </tr>
                             </table>
                         </td>
diff --git a/web/templates/user/list_dns_rec.html b/web/templates/user/list_dns_rec.html
index c2bd88378..19014a77b 100644
--- a/web/templates/user/list_dns_rec.html
+++ b/web/templates/user/list_dns_rec.html
@@ -76,7 +76,7 @@
                                     <td class="log" width="239px"><b><?php echo $data[$key]['RECORD'] ?></b></td>
                                     <td class="log-counter-value" width="57px"><?php echo $data[$key]['TYPE'] ?></td>
                                     <td class="log-counter-value" width="62px"><?php echo $data[$key]['PRIORITY'] ?></td>
-                                    <td class="log-counter-value" ><?php echo $data[$key]['VALUE'] ?></td>
+                                    <td class="log-counter-value" ><?php echo htmlspecialchars($data[$key]['VALUE'], ENT_QUOTES, 'UTF-8') ?></td>
                                 </tr>
                             </table>
                         </td>