From 1bb6bd8405d19d7877b14daf7fbee77db1eed5fa Mon Sep 17 00:00:00 2001 From: Jellyfrog Date: Thu, 9 Jul 2020 19:48:36 +0200 Subject: [PATCH] Sanitize graph title input (#11919) --- includes/html/graphs/graph.inc.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/includes/html/graphs/graph.inc.php b/includes/html/graphs/graph.inc.php index 020f8bb289..673f23f7a1 100644 --- a/includes/html/graphs/graph.inc.php +++ b/includes/html/graphs/graph.inc.php @@ -60,7 +60,7 @@ function graph_error($string) include 'includes/html/graphs/common.inc.php'; $rrd_options .= ' HRULE:0#555555'; - $rrd_options .= " --title='".$string."'"; + $rrd_options .= " --title=" . escapeshellarg($string); rrdtool_graph($graphfile, $rrd_options);