X-Git-Url: https://vcs.fsf.org/?p=squirrelmail.git;a=blobdiff_plain;f=plugins%2Fnewmail%2Fsetup.php;h=12bd65f75679a6926ce1cdd25ec2bedee2a7375c;hp=9364b9a76ef2844fd4262a7d6cf07798654d3e4d;hb=a9e1e670fab4399260e0790e018393c7dcefcecc;hpb=164584f0e97ba654bfe742bf6641dc53ae0f6827

diff --git a/plugins/newmail/setup.php b/plugins/newmail/setup.php
index 9364b9a7..12bd65f7 100644
--- a/plugins/newmail/setup.php
+++ b/plugins/newmail/setup.php
@@ -215,7 +215,8 @@
             }
 
             if ($totalNew > 0 && $newmail_enable == 'on' && $newmail_media != '' ) {
-                echo "<EMBED SRC=\"$newmail_media\" HIDDEN=TRUE AUTOSTART=TRUE>\n";
+                echo '<EMBED SRC="'.htmlspecialchars($newmail_media) .
+                    "\" HIDDEN=\"TRUE\" AUTOSTART=\"TRUE\">\n";
             }
             if ($totalNew > 0 && $newmail_popup == 'on') {
                 echo "<SCRIPT LANGUAGE=\"JavaScript\">\n".