From bfe91d9da3c52612f2c8df1e6fdc20ec5a92f94c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Christian=20K=C3=B6nig?= <ckoenig@posteo.de>
Date: Sat, 12 Feb 2022 09:10:19 +0100
Subject: [PATCH] Prevent code injection
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Christian König <ckoenig@posteo.de>
---
 settings.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/settings.php b/settings.php
index 543dd56d..e46dda66 100644
--- a/settings.php
+++ b/settings.php
@@ -20,7 +20,7 @@ if(isset($last_error) && ($last_error["type"] === E_WARNING || $last_error["type
 }
 
 # Timezone is set in docker via ENV otherwise get it from commandline
-$timezone=getenv("TZ");
+$timezone=htmlspecialchars(getenv("TZ"));
 if (empty($timezone)) {
 	$timezone=shell_exec("date +'%Z'");
 }