sanitizing folder name display.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@8174 7612ce4b-ef26-0410-bec9-ea0150e637f0

diff --git a/functions/imap_mailbox.php b/functions/imap_mailbox.php
index 3d7f87f62aa7247445355aa4b88c4e60844bb72d..5eb359e44e5d137ffe841deb3481a61889c9a864 100755 (executable)
--- a/functions/imap_mailbox.php
+++ b/functions/imap_mailbox.php
@@ -532,10 +532,10 @@ function sqimap_mailbox_option_list($imap_stream, $show_selected = 0, $folder_sk
                 switch ($shorten_box_names)
                 {
                   case 2:   /* delimited, style = 2 */
-                    $box2 = str_replace('  ', '. ', $boxes_part['formatted']);
+                    $box2 = str_replace('  ', '. ', htmlspecialchars($boxes_part['formatted']));
                     break;
                   case 1:   /* indent, style = 1 */
-                    $box2 = $boxes_part['formatted'];
+                    $box2 = str_replace('  ', '  ', htmlspecialchars($boxes_part['formatted']));
                     break;
                   default:  /* default, long names, style = 0 */
                     $box2 = str_replace(' ', ' ', htmlspecialchars(imap_utf7_decode_local($boxes_part['unformatted-disp'])));