From 22d7df91163ea2e330f02ad3f165e8fd23e3627b Mon Sep 17 00:00:00 2001 From: DL6ER Date: Wed, 3 Feb 2021 14:01:43 +0100 Subject: [PATCH] Properly escape possible user-input Signed-off-by: DL6ER --- scripts/pi-hole/php/auth.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/pi-hole/php/auth.php b/scripts/pi-hole/php/auth.php index 7398cbdf..2046261a 100644 --- a/scripts/pi-hole/php/auth.php +++ b/scripts/pi-hole/php/auth.php @@ -83,7 +83,7 @@ function check_cors() { $server_origin = str_replace(array("[","]","http://","https://"), array("","","",""), $server_origin); if(!in_array($server_origin, $AUTHORIZED_HOSTNAMES)) { - log_and_die("Failed CORS: " . $server_origin .' vs '. join(', ', $AUTHORIZED_HOSTNAMES)); + log_and_die("Failed CORS: " . htmlspecialchars($server_origin) .' vs '. join(', ', $AUTHORIZED_HOSTNAMES)); } header("Access-Control-Allow-Origin: ${_SERVER['HTTP_ORIGIN']}"); }