$abook->error is never htmlsanitized in 1.5.2cvs.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@11599 7612ce4b-ef26-0410-bec9-ea0150e637f0

diff --git a/src/addressbook.php b/src/addressbook.php
index d5e4ccd769594c427fdcd3e5bf8c711e42aaea26..cb95e4a16b6dbc94a3e19f6ee00db8494313054a 100644 (file)
--- a/src/addressbook.php
+++ b/src/addressbook.php
@@ -189,7 +189,7 @@ if(sqgetGlobalVar('REQUEST_METHOD', $req_method, SQ_SERVER) && $req_method == 'P
                     /* Handle error messages */
                     if (!$r) {
                         /* Display error */
-                        plain_error_message( _("ERROR") .': '. $abook->error);
+                        plain_error_message( nl2br(htmlspecialchars(_("ERROR") .': '. $abook->error));
 
                         /* Display the "new address" form again */
                         abook_create_form($form_url,'editaddr',_("Update address"),_("Update address"),$newdata);