Do not HTML escape stuff we just got from the user before writing it to LDAP,

[mirror/userdir-ldap-cgi.git] / search.cgi

diff --git a/search.cgi b/search.cgi
index ff99da3..e3eb882 100755 (executable)
--- a/search.cgi
+++ b/search.cgi
@@ -118,6 +118,9 @@ if (!$dosearch) {
   foreach $dn (sort {$entries->{$a}->{sn}->[0] <=> $entries->{$b}->{sn}->[0]} keys(%$entries)) {
     my $ok = 0;
     $data = $entries->{$dn};
+    for my $key (keys %{$data}) {
+      @{$data->{$key}} = map { CGI::escapeHTML($_); } @{$data->{$key}};
+    }
 
     # These are local variables.. i have enough global vars as it is... <sigh>
     my ($ufdn, $login, $name, $icquin, $jabberjid, $email, $fingerprint,