From 50d7febb6472d3b797928693f2d47f20913b6777 Mon Sep 17 00:00:00 2001
From: Chad Parry <github@chad.parry.org>
Date: Fri, 22 Apr 2011 14:43:47 -0600
Subject: [PATCH] Don't forget to escape unsafe characters in error messages.

---
 3.0/modules/rawphoto/views/admin_rawphoto.html.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/3.0/modules/rawphoto/views/admin_rawphoto.html.php b/3.0/modules/rawphoto/views/admin_rawphoto.html.php
index 71e2f699..eadec8f9 100644
--- a/3.0/modules/rawphoto/views/admin_rawphoto.html.php
+++ b/3.0/modules/rawphoto/views/admin_rawphoto.html.php
@@ -15,7 +15,7 @@
       <p><?= t("The dcraw tool was detected at <code>%path</code>.",
                array("path" => $dcraw->path)) ?></p>
     <? else: ?>
-      <p class="g-module-status g-error g-block"><?= $dcraw->error ?></p>
+      <p class="g-module-status g-error g-block"><?= html::chars($dcraw->error) ?></p>
     <? endif; ?>
     <? if ($toolkit_name == "none"): ?>
       <p class="g-module-status g-error g-block">
@@ -28,7 +28,7 @@
                array("toolkit_name" => $toolkit_name)) ?></p>
     <? endif; ?>
     <? if (!empty($errors["IccPath"])): ?>
-      <p class="g-module-status g-error g-block"><?= $errors["IccPath"] ?></p>
+      <p class="g-module-status g-error g-block"><?= html::chars($errors["IccPath"]) ?></p>
     <? endif; ?>
     <?= form::label("IccPath", t('Path to <a href="%icc_url">ICC profile</a>', array("icc_url" =>
           "http://www.permajet.com/30/Downloads/76/What_are_ICC_Profiles,_and_why_do_I_need_them.html"))) ?>