Properly escape possible user-input

Signed-off-by: DL6ER <[email protected]>
pi-hole · Feb 3, 2021 · 22d7df9 · 22d7df9
1 parent 6ff083a
commit 22d7df9
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/scripts/pi-hole/php/auth.php b/scripts/pi-hole/php/auth.php
@@ -83,7 +83,7 @@ function check_cors() {
         $server_origin = str_replace(array("[","]","http://","https://"), array("","","",""), $server_origin);
 
         if(!in_array($server_origin, $AUTHORIZED_HOSTNAMES)) {
-            log_and_die("Failed CORS: " . $server_origin .' vs '. join(', ', $AUTHORIZED_HOSTNAMES));
+            log_and_die("Failed CORS: " . htmlspecialchars($server_origin) .' vs '. join(', ', $AUTHORIZED_HOSTNAMES));
         }
         header("Access-Control-Allow-Origin: ${_SERVER['HTTP_ORIGIN']}");
     }