From bc1fb8eef2043d6e27cdf7c41e67228bab7f0224 Mon Sep 17 00:00:00 2001
From: Isaac Connor <isaac@zoneminder.com>
Date: Thu, 25 Jan 2024 19:04:15 -0500
Subject: [PATCH] Protect against XSS from User field

---
 web/skins/classic/views/user.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/web/skins/classic/views/user.php b/web/skins/classic/views/user.php
index f46516fb0..0652bec91 100644
--- a/web/skins/classic/views/user.php
+++ b/web/skins/classic/views/user.php
@@ -104,15 +104,15 @@ echo getNavBarHTML();
               </tr>
               <tr class="Name">
                 <th scope="row"><?php echo translate('Full Name') ?></th>
-                <td><input type="text" name="user[Name]" value="<?php echo $User->Name() ?>"/></td>
+                <td><input type="text" name="user[Name]" value="<?php echo validHtmlStr($User->Name()) ?>"/></td>
               </tr>
               <tr class="Email">
                 <th scope="row"><?php echo translate('Email Address') ?></th>
-                <td><input type="email" name="user[Email]" value="<?php echo $User->Email() ?>"/></td>
+                <td><input type="email" name="user[Email]" value="<?php echo validHtmlStr($User->Email()) ?>"/></td>
               </tr>
               <tr class="Phone">
                 <th scope="row"><?php echo translate('Phone') ?></th>
-                <td><input type="tel" name="user[Phone]" value="<?php echo $User->Phone() ?>"/></td>
+                <td><input type="tel" name="user[Phone]" value="<?php echo validHtmlStr($User->Phone()) ?>"/></td>
               </tr>
               <tr class="Language">
                 <th scope="row"><?php echo translate('Language') ?></th>