From 0cf258ae934ca20335b13c40c86d9e2e1b7a3363 Mon Sep 17 00:00:00 2001
From: alex-brainstorm <alex-brainstorm@7612ce4b-ef26-0410-bec9-ea0150e637f0>
Date: Wed, 30 Jul 2003 14:29:46 +0000
Subject: [PATCH] html encode mailbox names

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@5483 7612ce4b-ef26-0410-bec9-ea0150e637f0
---
 src/folders.php        | 8 ++++----
 src/folders_delete.php | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/folders.php b/src/folders.php
index 9a183392..aeedc2d0 100644
--- a/src/folders.php
+++ b/src/folders.php
@@ -263,9 +263,9 @@ if ($count_special_folders < count($boxes)) {
             ($boxes[$i]["unformatted"] != $trash_folder) &&
             ($boxes[$i]["unformatted"] != $sent_folder) &&
             ($boxes[$i]["unformatted"] != $draft_folder)) {
-            $box = $boxes[$i]["unformatted-dm"];
+            $box = htmlspecialchars($boxes[$i]["unformatted-dm"]);
             $box2 = str_replace(' ', '&nbsp;',
-                                imap_utf7_decode_local($boxes[$i]["unformatted-disp"]));
+                                htmlentities(imap_utf7_decode_local($boxes[$i]["unformatted-disp"])));
             echo "         <OPTION VALUE=\"$box\">$box2\n";
         }
     }
@@ -297,8 +297,8 @@ if(!$no_list_for_subscribe) {
         }
     }
     if ($use_folder == true) {
-        $box[$q] = $boxes_all[$i]['unformatted-dm'];
-        $box2[$q] = imap_utf7_decode_local($boxes_all[$i]['unformatted-disp']);
+        $box[$q] = htmlspecialchars($boxes_all[$i]['unformatted-dm']);
+        $box2[$q] = htmlentities(imap_utf7_decode_local($boxes_all[$i]['unformatted-disp']));
         $q++;
     }
   }
diff --git a/src/folders_delete.php b/src/folders_delete.php
index c6d914d7..de76a699 100644
--- a/src/folders_delete.php
+++ b/src/folders_delete.php
@@ -63,7 +63,7 @@ if( !sqgetGlobalVar('confirmed', $tmp, SQ_POST) ) {
         sprintf(_("Are you sure you want to delete %s?"), imap_utf7_decode_local($mailbox)).
         '<FORM ACTION="folders_delete.php" METHOD="POST"><p>'.
 
-        '<INPUT TYPE=HIDDEN NAME="mailbox" VALUE="'.$mailbox."\">\n" .
+        '<INPUT TYPE=HIDDEN NAME="mailbox" VALUE="' . htmlspecialchars($mailbox) . "\">\n" .
         '<INPUT TYPE=SUBMIT NAME="confirmed" VALUE="'._("Yes")."\">\n".
         '<INPUT TYPE=SUBMIT NAME="backingout" VALUE="'._("No")."\">\n".
         '</p></FORM><BR></td></tr></table>';
-- 
2.25.1