From 0ad041040401ef12c9a048f75df434afbdab3f6a Mon Sep 17 00:00:00 2001
From: Uwe Steinmann <steinm@debian.org>
Date: Mon, 6 Jan 2014 22:09:08 +0100
Subject: [PATCH] run cmd of converters through htmlspecialchars()

---
 views/bootstrap/class.Settings.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/views/bootstrap/class.Settings.php b/views/bootstrap/class.Settings.php
index f10279087..dc54e33f7 100644
--- a/views/bootstrap/class.Settings.php
+++ b/views/bootstrap/class.Settings.php
@@ -516,7 +516,7 @@ if(!is_writeable($settings->_configFilePath)) {
 ?>
       <tr title="<?php echo $mimetype;?>">
         <td><?php echo $mimetype;?>:</td>
-        <td><input type="text" name="converters[<?php echo $mimetype;?>]" value="<?php echo $cmd ?>" size="100" /></td>
+        <td><input type="text" name="converters[<?php echo $mimetype;?>]" value="<?php echo htmlspecialchars($cmd) ?>" size="100" /></td>
       </tr>
 <?php
 	}