From 29021b187f042f023584dd3986c086ca68bef0a2 Mon Sep 17 00:00:00 2001
From: "justdave%syndicomm.com" <>
Date: Fri, 25 Apr 2003 03:49:27 +0000
Subject: Bug 192677: Add new test to flag failure-to-filter situations in the
 templates, and correct the XSS holes that were discovered as a result of it.
 Patch by Gervase Markham <gerv@mozilla.org> r= myk, bbaetz, justdave a=
 justdave

---
 template/en/default/list/change-columns.html.tmpl | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'template/en/default/list/change-columns.html.tmpl')

diff --git a/template/en/default/list/change-columns.html.tmpl b/template/en/default/list/change-columns.html.tmpl
index 097a886bb..7730bf78c 100644
--- a/template/en/default/list/change-columns.html.tmpl
+++ b/template/en/default/list/change-columns.html.tmpl
@@ -36,7 +36,7 @@
 [% field_descs.qa_contact_realname  = "QA Contact Realname" %]
 
 <form action="colchange.cgi">
-  <input type="hidden" name="rememberedquery" value="[% buffer %]">
+  <input type="hidden" name="rememberedquery" value="[% buffer FILTER html %]">
   [% FOREACH column = masterlist %]
     <input type="checkbox" id="[% column %]" name="column_[% column %]" 
       [% "checked='checked'" IF lsearch(collist, column) != -1 %]>
@@ -65,7 +65,7 @@
 </form>
 
 <form action="colchange.cgi">
-  <input type="hidden" name="rememberedquery" value="[% buffer %]">
+  <input type="hidden" name="rememberedquery" value="[% buffer FILTER html %]">
   <input type="hidden" name="resetit" value="1">
   <input type="submit" value="Reset to Bugzilla default">
 </form>
-- 
cgit v1.2.3-24-g4f1b