Item13739: escape some chars in error message

foswiki · Sep 22, 2015 · 84f4ba6 · 84f4ba6
1 parent e48d3e3
commit 84f4ba6
Showing 1 changed file with 7 additions and 1 deletion.
diff --git a/core/lib/Foswiki/Users.pm b/core/lib/Foswiki/Users.pm
@@ -1030,7 +1030,13 @@ returns undef if no error
 
 sub passwordError {
     my ( $this, $cUID ) = @_;
-    return $this->_getMapping($cUID)->passwordError();
+
+    my $error = $this->_getMapping($cUID)->passwordError();
+    $error =~ s/&/&amp;/g;
+    $error =~ s/</&lt;/g;
+    $error =~ s/>/&gt;/g;
+
+    return $error;
 }
 
 =begin TML