From f18ab76b63605523edffea621b5e0a0609030808 Mon Sep 17 00:00:00 2001
From: Uwe Steinmann <steinm@debian.org>
Date: Fri, 20 Aug 2021 09:45:35 +0200
Subject: [PATCH] escape special chars in translation form

---
 views/bootstrap4/class.Bootstrap4.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/views/bootstrap4/class.Bootstrap4.php b/views/bootstrap4/class.Bootstrap4.php
index 2104311d2..55d5ab6fc 100644
--- a/views/bootstrap4/class.Bootstrap4.php
+++ b/views/bootstrap4/class.Bootstrap4.php
@@ -245,7 +245,7 @@ background-image: linear-gradient(to bottom, #882222, #111111);;
 			echo "<table class=\"table table-sm\">";
 			echo "<tr><th>Key</th><th>engl. Text</th><th>Your translation</th></tr>\n";
 			foreach($MISSING_LANG as $key=>$lang) {
-				echo "<tr><td>".$key."</td><td>".(isset($LANG['en_GB'][$key]) ? $LANG['en_GB'][$key] : '')."</td><td><div class=\"input-group send-missing-translation\"><input name=\"missing-lang-key\" type=\"hidden\" value=\"".$key."\" /><input name=\"missing-lang-lang\" type=\"hidden\" value=\"".$lang."\" /><input type=\"text\" class=\"form-control\" name=\"missing-lang-translation\" placeholder=\"Your translation in '".$lang."'\"/><div class=\"input-group-append\"><button class=\"btn btn-secondary\">Submit</button></div></div></td></tr>";
+				echo "<tr><td>".htmlspecialchars($key)."</td><td>".(isset($LANG['en_GB'][$key]) ? $LANG['en_GB'][$key] : '')."</td><td><div class=\"input-group send-missing-translation\"><input name=\"missing-lang-key\" type=\"hidden\" value=\"".$key."\" /><input name=\"missing-lang-lang\" type=\"hidden\" value=\"".$lang."\" /><input type=\"text\" class=\"form-control\" name=\"missing-lang-translation\" placeholder=\"Your translation in '".$lang."'\"/><div class=\"input-group-append\"><button class=\"btn btn-secondary\">Submit</button></div></div></td></tr>";
 			}
 			echo "</table>";
 			echo "<div class=\"splash\" data-type=\"error\" data-timeout=\"5500\"><b>There are missing translations on this page!</b><br />Please check the bottom of the page.</div>\n";