From f25d9c857df997a05c27af74f68af445f97146be Mon Sep 17 00:00:00 2001
From: Moritz Bunkus <m.bunkus@linet-services.de>
Date: Fri, 26 Sep 2008 08:35:33 +0000
Subject: [PATCH] Auch versteckte Variablen HTML-escapen.

---
 bin/mozilla/is.pl | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/bin/mozilla/is.pl b/bin/mozilla/is.pl
index e7c5a44bf..857681543 100644
--- a/bin/mozilla/is.pl
+++ b/bin/mozilla/is.pl
@@ -637,10 +637,10 @@ sub form_header {
       <table>
         <tr>
           $customers
-          <input type="hidden" name="customer_klass" value="$form->{customer_klass}">
-          <input type="hidden" name="customer_id" value="$form->{customer_id}">
-          <input type="hidden" name="oldcustomer" value="$form->{oldcustomer}">
-          <input type="hidden" name="selectcustomer" value="$form->{selectcustomer}">
+          <input type="hidden" name="customer_klass" value="| . H($form->{customer_klass}) . qq|">
+          <input type="hidden" name="customer_id" value="| . H($form->{customer_id}) . qq|">
+          <input type="hidden" name="oldcustomer" value="| . H($form->{oldcustomer}) . qq|">
+          <input type="hidden" name="selectcustomer" value="| . H($form->{selectcustomer}) . qq|">
         </tr>
         $contact
         $shipto
-- 
2.20.1